EUVD-2025-32279

The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2025-32278

The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketspot' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2025-9130 Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode

The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unifycheckout shortcode in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9130 Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode

The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unifycheckout shortcode in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9045

The CVE-2025-9045 entry describes a Stored Cross-Site Scripting (XSS) in the WordPress plugin Easy Elementor Addons (versions

CVE-2025-11241

The CVE CVE-2025-11241 (Yoast SEO Premium for WordPress) is a stored XSS vulnerability affecting plugin versions 25.7–25.9. It stems from a flawed regex used to strip an attribute in post content, enabling an attacker with Contributor or higher rights to inject arbitrary HTML attributes, includin...

CVE-2025-11241 Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allo...

CVE-2025-11241 Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allo...

PT-2025-40479

Name of the Vulnerable Software and Affected Versions Epic Bootstrap Buttons plugin for WordPress versions prior to 1.0 Description The plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-40502

Name of the Vulnerable Software and Affected Versions Event Tickets, RSVPs, Calendar versions up to and including 1.0.2 Description The Event Tickets, RSVPs, Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'ticket spot' shortcode. This is due to inadequate...

PT-2025-40489

Name of the Vulnerable Software and Affected Versions Meks Easy Maps plugin for WordPress versions through 2.1.4 Description The software is susceptible to Stored Cross-Site Scripting through the post title field. This is caused by inadequate input sanitization and output escaping of user-provide...

PT-2025-40468

Name of the Vulnerable Software and Affected Versions WP Photo Effects plugin for WordPress versions prior to 1.2.5 Description The WP Photo Effects plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'wppe effect' shortcode. This is due to inadequate input sanitization...

PT-2025-40477

Name of the Vulnerable Software and Affected Versions Schema Plugin For Divi, Gutenberg & Shortcodes versions prior to 4.3.2 Description The Schema Plugin For Divi, Gutenberg & Shortcodes for WordPress is susceptible to Object Instantiation up to version 4.3.2 through deserialization of untrusted...

PT-2025-40480

Name of the Vulnerable Software and Affected Versions Easy Elementor Addons versions prior to 2.2.8 Description The Easy Elementor Addons plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping in several widget...

PT-2025-40481

Name of the Vulnerable Software and Affected Versions Ultra Addons Lite for Elementor plugin for WordPress versions 1.1.9 and below Description The software contains a flaw due to insufficient input sanitization and output escaping in the 'Animated Text' field of the Typeout Widget. This allows...

PT-2025-40499

Name of the Vulnerable Software and Affected Versions A Simple Multilanguage Plugin versions prior to 1.0 Description The A Simple Multilanguage Plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'asmp-switcher' shortcode. Insufficient input sanitization and output...

PT-2025-40500

Name of the Vulnerable Software and Affected Versions Auto Bulb Finder for WordPress plugin versions prior to 2.8.1 Description The Auto Bulb Finder for WordPress plugin is susceptible to Stored Cross-Site Scripting through the 'abf vehicle' shortcode. Insufficient input sanitization and output...

PT-2025-40451

Name of the Vulnerable Software and Affected Versions Yoast SEO Premium plugin for WordPress versions 25.7 through 25.9 Description The software is susceptible to a Stored Cross-Site Scripting issue stemming from a flawed regular expression used to remove an attribute within post content. This fl...

PT-2025-40484

Name of the Vulnerable Software and Affected Versions Unify WordPress Plugin versions through 3.4.7 Description The Unify plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping on user-supplied attributes within the...

PT-2025-40503

Name of the Vulnerable Software and Affected Versions Ird Slider versions prior to 1.0.3 Description The Ird Slider plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s irdslider shortcode. Insufficient input sanitization and output escaping on user-supplied...