CVE-2024-13354: Improper Neutralization of Input During Web Page Generation

The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. Thi...

CVE-2024-12494: Improper Neutralization of Input During Web Page Generation

The BMLT Meeting Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmltmeetingmap' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12504

The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperhls' shortcode in all versions up to, and including, 6.1.9 due to insufficient input sanitization and output escaping on user...

CVE-2024-12118

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the htmltag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2024-12504: Improper Neutralization of Input During Web Page Generation

The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperhls' shortcode in all versions up to, and including, 6.1.9 due to insufficient input sanitization and output escaping on user...

CVE-2024-13340: Improper Neutralization of Input During Web Page Generation

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdfresultsbyajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-12117

The CVE-2024-12117 entry concerns Stackable – Page Builder Gutenberg Blocks for WordPress. It is a Stored Cross-Site Scripting (XSS) vulnerability in the Button block’s title parameter, affecting all versions up to and including 3.13.11 due to insufficient input sanitization and output escaping. ...

CVE-2024-13584: Improper Neutralization of Input During Web Page Generation

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperpictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplie...

CVE-2024-13590: Improper Neutralization of Input During Web Page Generation

The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11226

The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-0450: Improper Neutralization of Input During Web Page Generation

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-0371: Improper Neutralization of Input During Web Page Generation

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2024-11226: Improper Neutralization of Input During Web Page Generation

The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-0369

The CVE-2025-0369 issue concerns the JetEngine WordPress plugin. A Stored Cross-Site Scripting (XSS) flaw exists in the list_tag parameter, affecting all versions up to 3.6.2, due to insufficient input sanitization and output escaping. The vulnerability can be exploited by authenticated users wit...

CVE-2024-13385

CVE-2024-13385 – JSM Screenshot Machine Shortcode (WordPress) is a Stored Cross-Site Scripting vulnerability in the JSM Screenshot Machine Shortcode plugin for WordPress, affecting all versions up to 2.3.0. The issue arises from insufficient input sanitization and lack of proper output escaping o...

PT-2025-2144

Name of the Vulnerable Software and Affected Versions JSM Screenshot Machine Shortcode plugin for WordPress versions up to, and including, 2.3.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'ssm' shortcode due to insufficient input sanitization and output...

CVE-2024-12696: Improper Neutralization of Input During Web Page Generation

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisperpictureuploadguest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user...

CVE-2024-13392: Improper Neutralization of Input During Web Page Generation

The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperreviews' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13391: Improper Neutralization of Input During Web Page Generation

The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhispercontentuploadguest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input...

CVE-2024-13433: Improper Neutralization of Input During Web Page Generation

The Utilities for MTG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...