CVE-2024-13501

The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-7487

Name of the Vulnerable Software and Affected Versions Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress versions up to, and including, 2.7.5 Description The issue allows authenticated attackers, with Contributor-level access and above, to make web requests to...

CVE-2025-1064: Improper Neutralization of Input During Web Page Generation

The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xooelaction shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

PT-2025-7337

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.140 Description The issue is related to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget due to insufficient input sanitization...

CVE-2024-13802: Improper Neutralization of Input During Web Page Generation

The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintownevents' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-1328: Improper Neutralization of Input During Web Page Generation

The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

PT-2025-7499

Name of the Vulnerable Software and Affected Versions The Typed JS versions up to, and including, 1.2.0 Description The Typed JS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typespeed parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-7488

Name of the Vulnerable Software and Affected Versions Login/Signup Popup Inline Form + Woocommerce plugin for WordPress versions up to, and including, 2.8.5 Description The issue concerns a Stored Cross-Site Scripting vulnerability via the plugin's xoo el action shortcode due to insufficient inpu...

PT-2025-7450

Name of the Vulnerable Software and Affected Versions Content Blocks Custom Post Widget plugin for WordPress versions up to, and including, 3.3.5 Description The issue is related to Stored Cross-Site Scripting via the content parameter within the plugin's shortcode Content Block due to insufficie...

CVE-2025-1043: Server-Side Request Forgery (SSRF)

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-6432: Improper Neutralization of Input During Web Page Generation

The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's shortcode Content Block in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-13679

The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13592

The Team Builder For WPBakery Page BuilderFormerly Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above,...

CVE-2024-13589

The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ytgrid' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12522

The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13657 Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up to, and including, 2025r1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode

The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naeduelementortemplate shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

CVE-2024-13390

The CVE CVE-2024-13390 affects the WordPress plugin 'ADFO – Custom data in admin dashboard' (versions

CVE-2024-13663

CVE-2024-13663 involves the Coaching Staffs WordPress plugin. The issue is a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s mstw-cs-table shortcode. Impact is that an authenticated attacker ...

PT-2025-7326

Name of the Vulnerable Software and Affected Versions CanadaHelps Embedded Donation Form plugin for WordPress versions up to, and including, 1.0.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'embedcdn' shortcode due to insufficient input sanitization and outpu...