CVE-2025-11804 JB News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JB News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'jbticker' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2025-43043

Name of the Vulnerable Software and Affected Versions Simple Tableau Viz versions up to and including 2.0 Description The Simple Tableau Viz plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'tableau' shortcode. This is caused by inadequate input sanitization and outp...

CVE-2025-11878: Improper Neutralization of Input During Web Page Generation

The ST Categories Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's st-categories shortcode in versions less than, or equal to, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-11817: Improper Neutralization of Input During Web Page Generation

The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-43036

Name of the Vulnerable Software and Affected Versions This-or-That plugin for WordPress versions prior to 1.0.5 Description The This-or-That plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'thisorthat' shortcode. Insufficient input sanitization and output escaping o...

PT-2025-43057

Name of the Vulnerable Software and Affected Versions Responsive Progress Bar plugin for WordPress versions prior to 1.1 Description The Responsive Progress Bar plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s rprogress shortcode. This is due to inadequate...

CVE-2025-11883: Improper Neutralization of Input During Web Page Generation

The Responsive Progress Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rprogress shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

PT-2025-43039

Name of the Vulnerable Software and Affected Versions WP-Force Images Download versions up to and including 1.8 Description The WP-Force Images Download plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'wpfid' shortcode. This is caused by inadequate input sanitizatio...

PT-2025-43050

Name of the Vulnerable Software and Affected Versions WP AD Gallery versions up to and including 1.3 Description The WP AD Gallery plugin for WordPress is susceptible to Stored Cross-Site Scripting through the startindex parameter of the ad-gallery shortcode. Insufficient input sanitization and...

PT-2025-43037

Name of the Vulnerable Software and Affected Versions JB News Ticker plugin for WordPress versions up to and including 1.0 Description The JB News Ticker plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id shortcode attribute of the jbticker shortcode. This is caused...

PT-2025-43044

Name of the Vulnerable Software and Affected Versions WP Responsive Meet The Team versions up to and including 1.0.1 Description The WP Responsive Meet The Team plugin for WordPress has a Stored Cross-Site Scripting issue related to the wprm team shortcode. Insufficient input sanitization and...

PT-2025-43040

Name of the Vulnerable Software and Affected Versions Print Button Shortcode plugin for WordPress versions up to and including 1.0.1 Description The Print Button Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'print-button' shortcode. This is caused by...

PT-2025-43056

Name of the Vulnerable Software and Affected Versions SM CountDown Widget versions prior to 1.3 Description The SM CountDown Widget plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s smcountdown shortcode. This is due to inadequate input sanitization and outpu...

PT-2025-43051

Name of the Vulnerable Software and Affected Versions Photographers galleries plugin for WordPress versions up to and including 1.1.8 Description The Photographers galleries plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple shortcode attributes, including w, h, r...

CVE-2025-11880: Improper Neutralization of Input During Web Page Generation

The SM CountDown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's smcountdown shortcode in versions less than, or equal to, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-11872: Improper Neutralization of Input During Web Page Generation

The Material Design Iconic Font Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdiconic' shortcode in all versions up to, and including, 2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2025-11866: Improper Neutralization of Input During Web Page Generation

The Photographers galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes w, h, rawcss, look, etc. in all versions up to, and including, 1.1.8. This is due to the plugin not properly sanitizing user input or escaping output when inserting thes...

CVE-2025-11827: Improper Neutralization of Input During Web Page Generation

The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforewidget' and 'afterwidget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-11810: Improper Neutralization of Input During Web Page Generation

The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'target' attribute. This makes it possible for...

CVE-2025-11807: Improper Neutralization of Input During Web Page Generation

The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'url' attribute. This makes it possible for authenticated attacker...