PT-2025-42282

Name of the Vulnerable Software and Affected Versions Dhivehi Text plugin for WordPress versions up to and including 0.1 Description The Dhivehi Text plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s ‘dhivehi’ shortcode. This is due to inadequate input...

CVE-2025-10140: Improper Neutralization of Input During Web Page Generation

The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-11160: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes...

PT-2025-42300

Name of the Vulnerable Software and Affected Versions WP jQuery Pager plugin versions through 1.4.0 Description The WP jQuery Pager plugin for WordPress is susceptible to SQL Injection through the 'ids' shortcode attribute parameter. This is due to inadequate escaping of user-supplied input and...

CVE-2025-11161: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vccustomheading shortcode in all versions up to, and including, 8.6.1. This is due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes in the...

PT-2025-42289

Name of the Vulnerable Software and Affected Versions Shortcode Button plugin for WordPress versions up to and including 1.1.9 Description The plugin is susceptible to Stored Cross-Site Scripting through the 'button' shortcode. This is due to inadequate input sanitization and output escaping of...

PT-2025-42238

Name of the Vulnerable Software and Affected Versions WPBakery Page Builder versions prior to 8.6.1 Description The WPBakery Page Builder plugin for WordPress is affected by a Stored Cross-Site Scripting issue in the Custom JS module. Insufficient input sanitization and output escaping of...

PT-2025-42287

Name of the Vulnerable Software and Affected Versions Digiseller plugin for WordPress versions up to and including 1.3.0 Description The Digiseller plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s ‘ds’ shortcode. This is due to inadequate input sanitization...

PT-2025-42304

Name of the Vulnerable Software and Affected Versions Wp tabber widget plugin for WordPress versions prior to 4.1 Description The Wp tabber widget plugin for WordPress is susceptible to SQL Injection through the 'wp-tabber-widget' shortcode. Insufficient escaping of user-supplied parameters and...

PT-2025-42285

Name of the Vulnerable Software and Affected Versions WP BookWidgets plugin for WordPress versions up to and including 0.9 Description The WP BookWidgets plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'bw link' shortcode. This is due to inadequate input sanitizatio...

PT-2025-42284

Name of the Vulnerable Software and Affected Versions WP ViewSTL plugin for WordPress versions prior to 1.0 Description The WP ViewSTL plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'viewstl' shortcode. This is due to inadequate input sanitization and output escapi...

PT-2025-42283

Name of the Vulnerable Software and Affected Versions URLYar versions prior to 1.1.1 Description The URLYar URL Shortener plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'urlyar shortlink' shortcode. Insufficient input sanitization and output escaping on user-suppli...

CVE-2025-11722: Improper Control of Filename for Include/Require Statement in PHP Program

The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2025-11365: Improper Neutralization of Special Elements used in an SQL Command

The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'googlemap' shortcode in all versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-10575: Improper Neutralization of Special Elements used in an SQL Command

The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::getgallerypageimgs function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2025-10141: Improper Neutralization of Input During Web Page Generation

The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2025-10135: Improper Neutralization of Input During Web Page Generation

The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2025-10133: Improper Neutralization of Input During Web Page Generation

The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyarshortlink' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-10132: Improper Neutralization of Input During Web Page Generation

The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8561: Improper Neutralization of Alternate XSS Syntax

The Ova Advent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...