PT-2025-43709

Name of the Vulnerable Software and Affected Versions WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin versions prior to 8.5.42 Description The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin does not properly verify user authorization, leading to...

PT-2025-43714

Name of the Vulnerable Software and Affected Versions PublishPress Blocks plugin for WordPress versions up to and including 3.3.4 Description The plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. Specifically, the 'Marker Title' and...

PT-2025-43715

Name of the Vulnerable Software and Affected Versions Testimonial Carousel For Elementor plugin for WordPress versions prior to 11.6.3 Description The Testimonial Carousel For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and...

PT-2025-43730

Name of the Vulnerable Software and Affected Versions The7 — Website and eCommerce Builder for WordPress theme versions prior to 12.9.2 Description The software is susceptible to a Stored Cross-Site Scripting issue because of inadequate input sanitization and output escaping. This allows...

CVE-2025-8427

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-12096

The Simple Excel Pricelist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricelist' shortcode in all versions up to, and including, 1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-10748

The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2025-35814

The Simple Excel Pricelist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricelist' shortcode in all versions up to, and including, 1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-10748 RapidResult <= 1.2 - Authenticated (Contributor+) SQL Injection

The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2025-35816

The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-10748

CVE-2025-10748 affects the RapidResult WordPress plugin. It allows SQL Injection via the s parameter in all versions up to and including 1.2. The vulnerability arises from insufficient escaping of user input and inadequate preparation of the SQL query, enabling authenticated attackers with contri...

PT-2025-43602

Name of the Vulnerable Software and Affected Versions Simple Excel Pricelist for WooCommerce plugin for WordPress versions prior to 1.14 Description The Simple Excel Pricelist for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'pricelist' shortcode...

PT-2025-43587

Name of the Vulnerable Software and Affected Versions RapidResult plugin for WordPress versions up to and including 1.2 Description The RapidResult plugin for WordPress is susceptible to SQL Injection due to insufficient escaping of user-supplied input and inadequate preparation of existing SQL...

CVE-2025-7730

CVE-2025-7730 - Bold Page Builder (WordPress) Stored XSS : Wordfence reports a stored cross-site scripting vulnerability in Bold Page Builder up to version 5.4.5, exploitable by authenticated users with Contributor+ permissions via the percentage parameter. The flaw arises from insufficient input...

WordPress Bold Page Builder plugin <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via percentage Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Bold Page Builder versions = 5.4.5...

CVE-2025-8427

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-8427 Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-8427

Beaver Builder Plugin (Starter Version) for WordPress (

CVE-2025-10138

The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-11866

The Photographers galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes w, h, rawcss, look, etc. in all versions up to, and including, 1.1.8. This is due to the plugin not properly sanitizing user input or escaping output when inserting thes...