PT-2025-43041

Name of the Vulnerable Software and Affected Versions Simple Youtube Shortcode plugin for WordPress versions up to and including 1.1.3 Description The Simple Youtube Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the embed youtube shortcode. This is a result ...

PT-2025-43053

Name of the Vulnerable Software and Affected Versions Simple Business Data plugin for WordPress versions up to and including 1.0.1 Description The Simple Business Data plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'simple business data' shortcode attributes. The...

PT-2025-43043

Name of the Vulnerable Software and Affected Versions Simple Tableau Viz versions up to and including 2.0 Description The Simple Tableau Viz plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'tableau' shortcode. This is caused by inadequate input sanitization and outp...

PT-2025-43057

Name of the Vulnerable Software and Affected Versions Responsive Progress Bar plugin for WordPress versions prior to 1.1 Description The Responsive Progress Bar plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s rprogress shortcode. This is due to inadequate...

PT-2025-43048

Name of the Vulnerable Software and Affected Versions Oboxmedia Ads plugin for WordPress versions up to and including 1.9.8 Description The Oboxmedia Ads plugin for WordPress is susceptible to Stored Cross-Site Scripting through the before widget and after widget parameters of the oboxads-ad-widg...

PT-2025-42692

Name of the Vulnerable Software and Affected Versions WPBakery Page Builder plugin for WordPress versions prior to 8.6 Description The software is susceptible to Stored Cross-Site Scripting through the 'rev slider vc' shortcode due to inadequate input sanitization and output escaping of...

PT-2025-42691

Name of the Vulnerable Software and Affected Versions XX2WP Integration Tools versions prior to 1.9.9 Description The XX2WP Integration Tools plugin for WordPress is susceptible to Stored Cross-Site Scripting through the mxp fb2wp display embed shortcode. This occurs because the plugin does not...

CVE-2025-11857: Improper Neutralization of Input During Web Page Generation

The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxpfb2wpdisplayembed' shortcode in all versions up to, and including, 1.9.9. This is due to the plugin not properly sanitizing user input and output of the 'postid' parameter. This makes it...

PT-2025-42703

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 plugin for WordPress versions up to and including 3.2.6 Description The software contains a flaw that allows for the injection of malicious web scripts into pages. This is due to inadequate handling of...

CVE-2025-11270: Improper Neutralization of Input During Web Page Generation

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possib...

PT-2025-42289

Name of the Vulnerable Software and Affected Versions Shortcode Button plugin for WordPress versions up to and including 1.1.9 Description The plugin is susceptible to Stored Cross-Site Scripting through the 'button' shortcode. This is due to inadequate input sanitization and output escaping of...

CVE-2025-10133: Improper Neutralization of Input During Web Page Generation

The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyarshortlink' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-10141: Improper Neutralization of Input During Web Page Generation

The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

PT-2025-42285

Name of the Vulnerable Software and Affected Versions WP BookWidgets plugin for WordPress versions up to and including 0.9 Description The WP BookWidgets plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'bw link' shortcode. This is due to inadequate input sanitizatio...

PT-2025-42304

Name of the Vulnerable Software and Affected Versions Wp tabber widget plugin for WordPress versions prior to 4.1 Description The Wp tabber widget plugin for WordPress is susceptible to SQL Injection through the 'wp-tabber-widget' shortcode. Insufficient escaping of user-supplied parameters and...

CVE-2025-11161: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vccustomheading shortcode in all versions up to, and including, 8.6.1. This is due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes in the...

CVE-2025-10575: Improper Neutralization of Special Elements used in an SQL Command

The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::getgallerypageimgs function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2025-10140: Improper Neutralization of Input During Web Page Generation

The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-42300

Name of the Vulnerable Software and Affected Versions WP jQuery Pager plugin versions through 1.4.0 Description The WP jQuery Pager plugin for WordPress is susceptible to SQL Injection through the 'ids' shortcode attribute parameter. This is due to inadequate escaping of user-supplied input and...

PT-2025-42283

Name of the Vulnerable Software and Affected Versions URLYar versions prior to 1.1.1 Description The URLYar URL Shortener plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'urlyar shortlink' shortcode. Insufficient input sanitization and output escaping on user-suppli...