CVE-2025-11817: Improper Neutralization of Input During Web Page Generation

The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-43046

Name of the Vulnerable Software and Affected Versions Cinza Grid versions up to and including 1.2.1 Description The Cinza Grid plugin for WordPress is susceptible to Stored Cross-Site Scripting through the cgrid skin content post meta field. Insufficient input sanitization and output escaping all...

CVE-2025-10138: Improper Neutralization of Input During Web Page Generation

The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-11818: Improper Neutralization of Input During Web Page Generation

The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprmteam' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-43044

Name of the Vulnerable Software and Affected Versions WP Responsive Meet The Team versions up to and including 1.0.1 Description The WP Responsive Meet The Team plugin for WordPress has a Stored Cross-Site Scripting issue related to the wprm team shortcode. Insufficient input sanitization and...

PT-2025-43040

Name of the Vulnerable Software and Affected Versions Print Button Shortcode plugin for WordPress versions up to and including 1.0.1 Description The Print Button Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'print-button' shortcode. This is caused by...

CVE-2025-11866: Improper Neutralization of Input During Web Page Generation

The Photographers galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes w, h, rawcss, look, etc. in all versions up to, and including, 1.1.8. This is due to the plugin not properly sanitizing user input or escaping output when inserting thes...

PT-2025-43043

Name of the Vulnerable Software and Affected Versions Simple Tableau Viz versions up to and including 2.0 Description The Simple Tableau Viz plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'tableau' shortcode. This is caused by inadequate input sanitization and outp...

CVE-2025-11867: Improper Neutralization of Input During Web Page Generation

The Bg Book Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookauthor post meta, rendered through the bookauthor shortcode, in all versions up to, and including, 1.25. This is due to the plugin not properly escaping the meta value before output. This makes it...

PT-2025-43056

Name of the Vulnerable Software and Affected Versions SM CountDown Widget versions prior to 1.3 Description The SM CountDown Widget plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s smcountdown shortcode. This is due to inadequate input sanitization and outpu...

PT-2025-43055

Name of the Vulnerable Software and Affected Versions ST Categories Widget plugin for WordPress versions prior to 1.0.1 Description The ST Categories Widget plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s st-categories shortcode. This is caused by inadequat...

PT-2025-43039

Name of the Vulnerable Software and Affected Versions WP-Force Images Download versions up to and including 1.8 Description The WP-Force Images Download plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'wpfid' shortcode. This is caused by inadequate input sanitizatio...

PT-2025-43047

Name of the Vulnerable Software and Affected Versions Playerzbr versions prior to 1.7 Description The Playerzbr plugin for WordPress is susceptible to Stored Cross-Site Scripting through the urlmeta post meta field. Insufficient input sanitization and output escaping allow authenticated attackers...

CVE-2025-11872: Improper Neutralization of Input During Web Page Generation

The Material Design Iconic Font Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdiconic' shortcode in all versions up to, and including, 2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2025-43037

Name of the Vulnerable Software and Affected Versions JB News Ticker plugin for WordPress versions up to and including 1.0 Description The JB News Ticker plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id shortcode attribute of the jbticker shortcode. This is caused...

PT-2025-43036

Name of the Vulnerable Software and Affected Versions This-or-That plugin for WordPress versions prior to 1.0.5 Description The This-or-That plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'thisorthat' shortcode. Insufficient input sanitization and output escaping o...

PT-2025-43041

Name of the Vulnerable Software and Affected Versions Simple Youtube Shortcode plugin for WordPress versions up to and including 1.1.3 Description The Simple Youtube Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the embed youtube shortcode. This is a result ...

PT-2025-43053

Name of the Vulnerable Software and Affected Versions Simple Business Data plugin for WordPress versions up to and including 1.0.1 Description The Simple Business Data plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'simple business data' shortcode attributes. The...

PT-2025-43048

Name of the Vulnerable Software and Affected Versions Oboxmedia Ads plugin for WordPress versions up to and including 1.9.8 Description The Oboxmedia Ads plugin for WordPress is susceptible to Stored Cross-Site Scripting through the before widget and after widget parameters of the oboxads-ad-widg...

PT-2025-42692

Name of the Vulnerable Software and Affected Versions WPBakery Page Builder plugin for WordPress versions prior to 8.6 Description The software is susceptible to Stored Cross-Site Scripting through the 'rev slider vc' shortcode due to inadequate input sanitization and output escaping of...