CVE-2024-13461: Improper Neutralization of Input During Web Page Generation

The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on...

PT-2025-7504

Name of the Vulnerable Software and Affected Versions AMO Team Showcase plugin for WordPress versions up to, and including, 1.1.4 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the amoteam...

PT-2025-7503

Name of the Vulnerable Software and Affected Versions Newpost Catch plugin for WordPress versions up to, and including, 1.3.19 Description The issue is related to Stored Cross-Site Scripting via the plugin's npc shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-7505

Name of the Vulnerable Software and Affected Versions The Events Calendar Made Simple – Pie Calendar plugin for WordPress versions up to, and including, 1.2.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's piecal shortcode due to insufficient input sanitization a...

PT-2025-7373

Name of the Vulnerable Software and Affected Versions Maps for WP plugin for WordPress versions up to, and including, 1.2.4 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-7333

Name of the Vulnerable Software and Affected Versions Ziggeo plugin for WordPress versions up to, and including, 3.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'ziggeo event' shortcode due to insufficient input sanitization and output escaping on user-supplie...

CVE-2024-11895

The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVE-2024-13395

The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'threepress' shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-1064

The CVE-2025-1064 issue affects the WordPress plugin Login/Signup Popup (Inline Form + Woocommerce). It enables Stored XSS via the xoo_el_action shortcode due to insufficient input sanitization/output escaping on user-supplied attributes. Vulnerable versions include all up to 2.8.5. Attack scenar...

CVE-2024-12525

The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-12813

The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-13501

The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-7487

Name of the Vulnerable Software and Affected Versions Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress versions up to, and including, 2.7.5 Description The issue allows authenticated attackers, with Contributor-level access and above, to make web requests to...

CVE-2025-1064: Improper Neutralization of Input During Web Page Generation

The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xooelaction shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2025-1328: Improper Neutralization of Input During Web Page Generation

The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-1043: Server-Side Request Forgery (SSRF)

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and...

PT-2025-7337

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.140 Description The issue is related to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget due to insufficient input sanitization...

CVE-2024-13802: Improper Neutralization of Input During Web Page Generation

The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintownevents' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-7499

Name of the Vulnerable Software and Affected Versions The Typed JS versions up to, and including, 1.2.0 Description The Typed JS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typespeed parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-6432: Improper Neutralization of Input During Web Page Generation

The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's shortcode Content Block in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it...