PT-2025-1857

Name of the Vulnerable Software and Affected Versions Chatroll Live Chat plugin for WordPress versions up to and including 2.5.0 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'chatroll' shortcode. This allows...

CVE-2024-12464: Improper Neutralization of Input During Web Page Generation

The Chatroll Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chatroll' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-11934: Improper Neutralization of Input During Web Page Generation

The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-12624: Improper Neutralization of Input During Web Page Generation

The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up to, and including, 3.5.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-12437: Improper Neutralization of Input During Web Page Generation

The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-1847

Name of the Vulnerable Software and Affected Versions Marketplace Items plugin for WordPress versions up to, and including, 1.5.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'envato' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-12592: Improper Neutralization of Input During Web Page Generation

The Sellsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testSellsy' shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-1687

Name of the Vulnerable Software and Affected Versions SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress versions up to, and including, 2.0.6 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'sweepwidget' shortcode due to insufficien...

CVE-2024-12073: Improper Neutralization of Input During Web Page Generation

The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slideurlvalue' parameter in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-12538: Exposure of Sensitive Information to an Unauthorized Actor

The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.5 via the 'dppduplicateasdraft' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-11899: Improper Neutralization of Input During Web Page Generation

The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11756: Improper Neutralization of Input During Web Page Generation

The SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sweepwidget' shortcode in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping on user supplied...

PT-2025-1689

Name of the Vulnerable Software and Affected Versions Solar Wizard Lite plugin for WordPress versions 1.2.4 and earlier Description The issue is related to Stored Cross-Site Scripting via the plugin's 'solar wizard' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-1639

Name of the Vulnerable Software and Affected Versions Horoscope And Tarot plugin for WordPress versions up to, and including, 1.3.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'divine horoscope' shortcode due to insufficient input sanitization and output...

CVE-2024-12462: Improper Neutralization of Input During Web Page Generation

The YOGO Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yogo-calendar' shortcode in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-9502: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Tooltip module in all versions up to, and including, 2.0.6.7 due to insufficient input sanitization and...

CVE-2024-12140: Exposure of Sensitive Information to an Unauthorized Actor

The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it...

WordPress Slider Pro Lite plugin <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin Slider Pro Lite versions = 1.4.1...

CVE-2024-12583: Improper Neutralization of Special Elements Used in a Template Engine

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it...

CVE-2024-12475: Improper Neutralization of Input During Web Page Generation

The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje...