PT-2025-9803

Name of the Vulnerable Software and Affected Versions The Point Maker plugin for WordPress versions up to, and including, 0.1.6 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the point maker shortcode. This allows authenticated...

PT-2025-9817

Name of the Vulnerable Software and Affected Versions WordPress plugins using Featherlight.js versions 1.7.13 through 1.7.14 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Featherlight.js JavaScript library. This allows...

PT-2025-9802

Name of the Vulnerable Software and Affected Versions The Master Slider – Responsive Touch Slider plugin for WordPress versions up to, and including, 3.10.6 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's ms slider...

PT-2025-9806

Name of the Vulnerable Software and Affected Versions The Master Slider – Responsive Touch Slider plugin for WordPress versions up to, and including, 3.10.6 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's ms layer...

CVE-2024-13350: Improper Neutralization of Input During Web Page Generation

The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siqsearchbox' shortcode in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-13757: Improper Neutralization of Input During Web Page Generation

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mslayer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-1008: Improper Neutralization of Input During Web Page Generation

The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12815: Improper Neutralization of Input During Web Page Generation

The Point Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pointmaker' shortcode in all versions up to, and including, 0.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-0370

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-0958

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as...

CVE-2025-0958 Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as...

CVE-2025-1321

CVE-2025-1321 concerns the WordPress teachPress plugin. Connected sources confirm a SQL Injection via the tpsearch shortcode’s order parameter in all versions up to 9.0.7, caused by insufficient escaping and improper SQL query preparation. An authenticated attacker with Contributor-level access o...

PT-2025-9646

Name of the Vulnerable Software and Affected Versions The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress versions up to, and including, 2.0.7.1 Description The issue is related to Stored Cross-Site Scripting due to...

PT-2025-9649

Name of the Vulnerable Software and Affected Versions WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress versions up to, and including, 7.3.3 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via t...

PT-2025-9591

Name of the Vulnerable Software and Affected Versions teachPress plugin for WordPress versions up to, and including, 9.0.7 Description The issue allows authenticated attackers with Contributor-level access and above to perform SQL Injection via the order parameter of the "tpsearch" shortcode. Thi...

CVE-2025-0512: Improper Neutralization of Input During Web Page Generation

The Structured Content JSON-LD wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's scfslocalbusiness shortcode in all versions up to, and including, 6.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-0433: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output...

CVE-2025-0370: Improper Neutralization of Input During Web Page Generation

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-9618: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output...

CVE-2025-1321: Improper Neutralization of Special Elements used in an SQL Command

The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including, 9.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...