CVE-2025-1491

The WP Posts Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplaytimeout’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-1491

CVE-2025-1491 — WP Posts Carousel (WordPress) is vulnerable to Stored Cross-Site Scripting via the auto_play_timeout parameter in all versions up to 1.3.7. The issue arises from insufficient input sanitization and output escaping, enabling authenticated users with Contributor+ privileges to injec...

CVE-2024-13546

CVE-2024-13546 corresponds to the GenerateBlocks WordPress plugin vulnerability: authenticated (Contributor+) users can exploit a Sensitive Information Exposure via get_image_description, affecting all versions up to and including 1.9.1. The issue allows extraction of sensitive data, including co...

CVE-2025-1291

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icon’ parameter in all versions up to, and including, 3.4.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13559

CVE-2024-13559 concerns the TemplatesNext ToolKit WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (Stored XSS) in the plugin’s shortcodes, specifically tx_woo_wishlist_table, and affects all versions up to and including 3.2.9. The root cause is insufficient input sanitization...

CVE-2025-0820

CVE-2025-0820 (Clicface Trombi, WordPress) : The WordPress plugin is vulnerable to a Stored Cross-Site Scripting via the nom parameter in all versions up to and including 2.08. The issue arises from insufficient input sanitization and output escaping. Exploitation requires at least Contributor-le...

CVE-2025-1560

The WOW Entrance Effects WEE! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-13832 Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'utelementor' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2025-1405

The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's showproducts shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-1405

CVE-2025-1405 affects the WordPress plugin Product Catalog Simple (post-type-x). It is a stored XSS vulnerability via the plugin’s show_products shortcode in versions up to 1.7.11, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires an ...

CVE-2024-12820

CVE-2024-12820 concerns the MK Google Directions plugin for WordPress. The vulnerability is an authenticated (Contributor+) Stored Cross-Site Scripting via the plugin’s MKGD shortcode , caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: attackers wi...

CVE-2025-1690

The CVE-2025-1690 entry concerns ThemeMakers Stripe Checkout for WordPress, which has a Stored Cross-Site Scripting (XSS) flaw in the stripe shortcode up to version 1.0.1 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions can inj...

CVE-2024-6261

CVE-2024-6261 affects the Image Photo Gallery Final Tiles Grid plugin for WordPress. It is a Stored DOM-based Cross-Site Scripting vulnerability via the FinalTilesGallery shortcode in all versions up to 3.6.0. Exploitation requires authenticated access at contributor level or higher, enabling inj...

CVE-2025-0469

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-0469

CVE-2025-0469 : Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WordPress) is affected by a Stored Cross-Site Scripting vulnerability up to version 1.39.2 due to insufficient input sanitization and output escaping in the slider template data. An attacker with Contributor+ pri...

CVE-2025-1489

The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2024-12452

The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeoevent' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-13648

The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13445

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap parameters in all versions up to, and including, 3.27.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2025-1489

The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...