PT-2025-12836

Name of the Vulnerable Software and Affected Versions Advanced Woo Search plugin for WordPress versions up to, and including, 3.28 Description The issue is related to Stored Cross-Site Scripting via the plugin's aws search terms shortcode due to insufficient input sanitization and output escaping...

PT-2025-12766

Name of the Vulnerable Software and Affected Versions DICOM Support plugin for WordPress versions 0.10.6 and earlier Description The issue is related to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-12736

Name of the Vulnerable Software and Affected Versions DesignThemes Core Features plugin for WordPress versions up to, and including, 4.8 Description The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

CVE-2024-13731: Improper Neutralization of Input During Web Page Generation

The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box block in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-12623: Improper Neutralization of Input During Web Page Generation

The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-0845: Improper Neutralization of Input During Web Page Generation

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

PT-2025-12779

Name of the Vulnerable Software and Affected Versions The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress versions up to, and including, 1.1.2 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping ...

CVE-2025-2108

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'titletag' and 'htmltag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This...

PT-2025-12470

Name of the Vulnerable Software and Affected Versions The Block Logic – Full Gutenberg Block Display Control plugin for WordPress versions 1.0.8 and earlier Description The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution due to the...

CVE-2025-2108

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'titletag' and 'htmltag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This...

PT-2025-12328

Name of the Vulnerable Software and Affected Versions HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.8.3 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

CVE-2025-1770: Improper Limitation of a Pathname to a Restricted Directory

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2025-2108: Improper Neutralization of Input During Web Page Generation

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'titletag' and 'htmltag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This...

PT-2025-12013

Name of the Vulnerable Software and Affected Versions The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress versions up to, and including, 1.4.6.8 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the...

WordPress Eventin plugin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by wesley wcraft in WordPress Plugin Eventin versions = 4.0.24...

PT-2025-11250

Name of the Vulnerable Software and Affected Versions: Omnipress plugin for WordPress versions up to, and including, 1.5.4 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from password-protected, private, or draft posts that they shoul...

PT-2025-11251

Name of the Vulnerable Software and Affected Versions: DethemeKit for Elementor plugin for WordPress versions up to, and including, 2.1.9 Description: The issue is related to Stored Cross-Site Scripting via the De Product Display Widget's countdown feature, caused by insufficient input sanitizati...

CVE-2024-13407: Authorization Bypass Through User-Controlled Key

The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above,...

CVE-2025-1526: Improper Neutralization of Input During Web Page Generation

The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget countdown feature in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-1503 WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Roundup Recipe Name field in all versions up to, and including, 9.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...