CVE-2024-13802: Improper Neutralization of Input During Web Page Generation

The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintownevents' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-7499

Name of the Vulnerable Software and Affected Versions The Typed JS versions up to, and including, 1.2.0 Description The Typed JS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typespeed parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-6432: Improper Neutralization of Input During Web Page Generation

The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's shortcode Content Block in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it...

PT-2025-7488

Name of the Vulnerable Software and Affected Versions Login/Signup Popup Inline Form + Woocommerce plugin for WordPress versions up to, and including, 2.8.5 Description The issue concerns a Stored Cross-Site Scripting vulnerability via the plugin's xoo el action shortcode due to insufficient inpu...

PT-2025-7450

Name of the Vulnerable Software and Affected Versions Content Blocks Custom Post Widget plugin for WordPress versions up to, and including, 3.3.5 Description The issue is related to Stored Cross-Site Scripting via the content parameter within the plugin's shortcode Content Block due to insufficie...

CVE-2024-13679

The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13592

The Team Builder For WPBakery Page BuilderFormerly Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above,...

CVE-2024-13589

The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ytgrid' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12522

The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13657 Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up to, and including, 2025r1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode

The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naeduelementortemplate shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

CVE-2024-13390

The CVE CVE-2024-13390 affects the WordPress plugin 'ADFO – Custom data in admin dashboard' (versions

CVE-2024-13663

CVE-2024-13663 involves the Coaching Staffs WordPress plugin. The issue is a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s mstw-cs-table shortcode. Impact is that an authenticated attacker ...

CVE-2025-1065: Improper Neutralization of Input During Web Page Generation

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied...

PT-2025-7326

Name of the Vulnerable Software and Affected Versions CanadaHelps Embedded Donation Form plugin for WordPress versions up to, and including, 1.0.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'embedcdn' shortcode due to insufficient input sanitization and outpu...

CVE-2024-13592: Improper Control of Filename for Include/Require Statement in PHP Program

The Team Builder For WPBakery Page BuilderFormerly Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above,...

PT-2025-6547

Name of the Vulnerable Software and Affected Versions Easypromos Plugin versions up to, and including, 1.3.8 Description The issue is related to Stored Cross-Site Scripting via the plugin's Easypromos shortcode due to insufficient input sanitization and output escaping on user-supplied attributes...

PT-2025-7376

Name of the Vulnerable Software and Affected Versions The Coaching Staffs plugin for WordPress versions up to, and including, 1.4 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'mstw-cs-table' shortcode due to insufficient input sanitization and output escaping o...

PT-2025-7378

Name of the Vulnerable Software and Affected Versions The Cosmic Blocks 40+ Content Editor Blocks Collection plugin for WordPress versions up to, and including, 1.3.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's cwp social share shortcode due to insufficient...

PT-2025-7370

Name of the Vulnerable Software and Affected Versions YouTube Playlists with Schema plugin for WordPress versions up to, and including, 2.6.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'yt grid' shortcode due to insufficient input sanitization and output...