PT-2025-43039

Name of the Vulnerable Software and Affected Versions WP-Force Images Download versions up to and including 1.8 Description The WP-Force Images Download plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'wpfid' shortcode. This is caused by inadequate input sanitizatio...

CVE-2025-11883: Improper Neutralization of Input During Web Page Generation

The Responsive Progress Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rprogress shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

PT-2025-43050

Name of the Vulnerable Software and Affected Versions WP AD Gallery versions up to and including 1.3 Description The WP AD Gallery plugin for WordPress is susceptible to Stored Cross-Site Scripting through the startindex parameter of the ad-gallery shortcode. Insufficient input sanitization and...

PT-2025-43037

Name of the Vulnerable Software and Affected Versions JB News Ticker plugin for WordPress versions up to and including 1.0 Description The JB News Ticker plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id shortcode attribute of the jbticker shortcode. This is caused...

PT-2025-43051

Name of the Vulnerable Software and Affected Versions Photographers galleries plugin for WordPress versions up to and including 1.1.8 Description The Photographers galleries plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple shortcode attributes, including w, h, r...

CVE-2025-11880: Improper Neutralization of Input During Web Page Generation

The SM CountDown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's smcountdown shortcode in versions less than, or equal to, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-11872: Improper Neutralization of Input During Web Page Generation

The Material Design Iconic Font Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdiconic' shortcode in all versions up to, and including, 2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2025-11866: Improper Neutralization of Input During Web Page Generation

The Photographers galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes w, h, rawcss, look, etc. in all versions up to, and including, 1.1.8. This is due to the plugin not properly sanitizing user input or escaping output when inserting thes...

CVE-2025-11827: Improper Neutralization of Input During Web Page Generation

The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforewidget' and 'afterwidget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-11807: Improper Neutralization of Input During Web Page Generation

The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'url' attribute. This makes it possible for authenticated attacker...

PT-2025-43047

Name of the Vulnerable Software and Affected Versions Playerzbr versions prior to 1.7 Description The Playerzbr plugin for WordPress is susceptible to Stored Cross-Site Scripting through the urlmeta post meta field. Insufficient input sanitization and output escaping allow authenticated attackers...

PT-2025-43053

Name of the Vulnerable Software and Affected Versions Simple Business Data plugin for WordPress versions up to and including 1.0.1 Description The Simple Business Data plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'simple business data' shortcode attributes. The...

CVE-2025-11825: Improper Neutralization of Input During Web Page Generation

The Playerzbr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'urlmeta' post meta field in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2025-11830: Improper Neutralization of Input During Web Page Generation

The WP Restaurant Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter of the restaurantsummary shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-11818: Improper Neutralization of Input During Web Page Generation

The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprmteam' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-11819: Improper Neutralization of Input During Web Page Generation

The WP-Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'roboshot' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-10138: Improper Neutralization of Input During Web Page Generation

The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-43044

Name of the Vulnerable Software and Affected Versions WP Responsive Meet The Team versions up to and including 1.0.1 Description The WP Responsive Meet The Team plugin for WordPress has a Stored Cross-Site Scripting issue related to the wprm team shortcode. Insufficient input sanitization and...

PT-2025-43040

Name of the Vulnerable Software and Affected Versions Print Button Shortcode plugin for WordPress versions up to and including 1.0.1 Description The Print Button Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'print-button' shortcode. This is caused by...

PT-2025-43054

Name of the Vulnerable Software and Affected Versions Material Design Iconic Font Integration versions prior to 3 Description The plugin is susceptible to Stored Cross-Site Scripting through the 'mdiconic' shortcode due to inadequate input sanitization and output escaping of user-provided...