CVE-2024-12520: Improper Neutralization of Input During Web Page Generation

The Dominion – Domain Checker for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dominionshortcodesdomainsearch6' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11874: Improper Neutralization of Input During Web Page Generation

The Grid Accordion Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gridaccordion' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12304: Improper Neutralization of Input During Web Page Generation

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2024-13183 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titletag’ parameter in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12473 AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injection

The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT GPT-4o 128K plugin for WordPress is vulnerable to SQL Injection via the 'templateid' parameter of the 'articlebuildergeneratedata' shortcode in all versions up to, and...

CVE-2025-0311: Improper Neutralization of Input During Web Page Generation

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13183: Improper Neutralization of Input During Web Page Generation

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titletag’ parameter in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12491

The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'srsearchform' shortcode in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-12514

CVE-2024-12514 refers to the WordPress plugin 3D Viewer Online : a stored cross-site scripting flaw in the plugin’s '3Dvo-model' shortcode affecting all versions up to and including 2.2.2 . The vulnerability enables authenticated attackers with contributor-level access or higher to inject scripts...

CVE-2024-12515

The CVE CVE-2024-12515 affects the WordPress plugin Muslim Prayer Time-Salah/Iqamah (masjidal) up to version 1.8.8. It is a Stored Cross-Site Scripting flaw exploitable by authenticated attackers with Contributor-level access or higher via the Masjid ID parameter, due to insufficient input saniti...

CVE-2024-12819

CVE-2024-12819 affects the WordPress Searchie plugin up to version 1.17.0. The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin shortcode sio_embed_media, caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers ...

CVE-2024-12496

CVE-2024-12496 involves the WordPress Linear plugin (versions

CVE-2024-13153

CVE-2024-13153 affects the Unlimited Elements For Elementor plugin for WordPress. It enables Stored XSS via multiple widgets (Image Tooltip, Notification, Simple Popup, Video Play Button, Card Carousel) in all versions up to 1.5.135 due to insufficient input sanitization/escaped output on user at...

CVE-2024-13153: Improper Neutralization of Input During Web Page Generation

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-11907: Improper Neutralization of Input During Web Page Generation

The Skyword API Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skywordiframe' shortcode in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-1865

Name of the Vulnerable Software and Affected Versions SimplyRETS Real Estate IDX plugin for WordPress versions up to, and including, 2.11.2 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'sr search form' shortcode due to insufficient input sanitization and output...

CVE-2024-12819: Improper Neutralization of Input During Web Page Generation

The Searchie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sioembedmedia' shortcode in all versions up to, and including, 1.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12514: Improper Neutralization of Input During Web Page Generation

The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12493: Improper Neutralization of Input During Web Page Generation

The Files Download Delay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fddwrap' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12491: Improper Neutralization of Input During Web Page Generation

The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'srsearchform' shortcode in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...