CVE-2024-13501

The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13579 WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pollspopup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13575: Improper Neutralization of Input During Web Page Generation

The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webstoriesenhancer' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes...

PT-2025-6568

Name of the Vulnerable Software and Affected Versions Simple Map No Api plugin for WordPress versions up to, and including, 1.9 Description The issue is related to Stored Cross-Site Scripting via the width parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-6569

Name of the Vulnerable Software and Affected Versions Zigaform – Form Builder Lite plugin for WordPress versions up to, and including, 7.4.2 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'zgfm rfvar' shortcode due to insufficient input sanitization and output...

CVE-2024-13464: Improper Neutralization of Input During Web Page Generation

The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all versions up to, and including, 5.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13578: Improper Neutralization of Input During Web Page Generation

The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-6801

Name of the Vulnerable Software and Affected Versions Mortgage Calculator / Loan Calculator plugin for WordPress versions up to, and including, 1.5.20 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode due to insufficient input sanitization and...

PT-2025-6570

Name of the Vulnerable Software and Affected Versions Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress versions up to, and including, 1.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'web stories enhancer' shortcode due to insufficient inpu...

CVE-2024-13577: Improper Neutralization of Input During Web Page Generation

The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13465: Improper Neutralization of Input During Web Page Generation

The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the "markerView" attribute, in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This mak...

PT-2025-6573

Name of the Vulnerable Software and Affected Versions WP-BibTeX plugin for WordPress versions up to, and including, 3.0.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode due to insufficient input sanitization and output escaping on user-suppli...

CVE-2024-13579: Improper Neutralization of Input During Web Page Generation

The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pollspopup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13588: Improper Neutralization of Input During Web Page Generation

The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13501: Improper Neutralization of Input During Web Page Generation

The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13565: Improper Neutralization of Input During Web Page Generation

The Simple Map No Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-13743: Improper Neutralization of Input During Web Page Generation

The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderpluginvideo shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-6607

Name of the Vulnerable Software and Affected Versions Wonder Video Embed plugin for WordPress versions up to and including 2.2 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wonderplugin video shortcode. This allows...

CVE-2024-12813: Improper Neutralization of Input During Web Page Generation

The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-13581: Improper Neutralization of Input During Web Page Generation

The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplechart' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...