PT-2025-6801

Name of the Vulnerable Software and Affected Versions Mortgage Calculator / Loan Calculator plugin for WordPress versions up to, and including, 1.5.20 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode due to insufficient input sanitization and...

CVE-2024-13579: Improper Neutralization of Input During Web Page Generation

The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pollspopup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-6570

Name of the Vulnerable Software and Affected Versions Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress versions up to, and including, 1.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'web stories enhancer' shortcode due to insufficient inpu...

CVE-2024-13578: Improper Neutralization of Input During Web Page Generation

The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-6573

Name of the Vulnerable Software and Affected Versions WP-BibTeX plugin for WordPress versions up to, and including, 3.0.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode due to insufficient input sanitization and output escaping on user-suppli...

PT-2025-6568

Name of the Vulnerable Software and Affected Versions Simple Map No Api plugin for WordPress versions up to, and including, 1.9 Description The issue is related to Stored Cross-Site Scripting via the width parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-6527

Name of the Vulnerable Software and Affected Versions Open Hours – Easy Opening Hours plugin for WordPress versions up to and including 1.0.9 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'open-hours-current-statu...

CVE-2024-13581: Improper Neutralization of Input During Web Page Generation

The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplechart' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-6576

Name of the Vulnerable Software and Affected Versions Simple Pricing Tables For WPBakery Page Builder plugin for WordPress versions up to, and including, 1.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'wdo simple pricing table free' shortcode due to...

PT-2025-6548

Name of the Vulnerable Software and Affected Versions Library Bookshelves plugin for WordPress versions up to, and including, 5.9 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'bookshelf' shortcode. This allows...

PT-2025-6521

Name of the Vulnerable Software and Affected Versions Easy MLS Listings Import plugin for WordPress versions up to and including 2.0.1 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the homeasap-featured-listings shortcode. Thi...

CVE-2024-11895: Improper Neutralization of Input During Web Page Generation

The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

PT-2025-6607

Name of the Vulnerable Software and Affected Versions Wonder Video Embed plugin for WordPress versions up to and including 2.2 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wonderplugin video shortcode. This allows...

CVE-2024-13743: Improper Neutralization of Input During Web Page Generation

The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderpluginvideo shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-6510

Name of the Vulnerable Software and Affected Versions Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress versions prior to 3.20.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output...

CVE-2024-13464: Improper Neutralization of Input During Web Page Generation

The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all versions up to, and including, 5.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12525: Improper Neutralization of Input During Web Page Generation

The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13588: Improper Neutralization of Input During Web Page Generation

The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13577: Improper Neutralization of Input During Web Page Generation

The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13576: Improper Neutralization of Input During Web Page Generation

The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...