WordPress SKT Blocks plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Prissy in WordPress Plugin SKT Blocks versions = 2.6...

WordPress WPFront User Role Editor Plugin <= 4.2.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin WPFront User Role Editor versions = 4.2.3...

WordPress Stackable Plugin <= 3.18.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Abu Hurayra in WordPress Plugin Stackable versions = 3.18.1...

CVE-2025-10180 Markdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-10180 Markdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-9490

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-9490 Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-9490 Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-8200

The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-8906

The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8200

CVE-2025-8200 affects Mega Elements – Addons for Elementor (WordPress): Stored Cross-Site Scripting via the Countdown Timer widget in all versions up to 1.3.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at least contributor-lev...

CVE-2025-10178

CVE-2025-10178 is a stored XSS vulnerability in the CM Business Directory WordPress plugin, exploitable via the plugin shortcode cmbd_featured_image on pages. Affected versions are all up to and including 1.5.2. The issue arises from insufficient input sanitization and output escaping on user-sup...

CVE-2025-8906

CVE-2025-8906 affects the WordPress plugin Widgets for Tiktok Feed (Widgets for TikTok Feed) up to version 1.7.3, enabling Stored XSS via the trustindex-feed shortcode. Exploitation requires attacker with contributor-level access or higher to inject script that runs in pages viewed by users. Word...

CVE-2025-8906 Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-39474

Name of the Vulnerable Software and Affected Versions CM Business Directory plugin for WordPress versions up to and including 1.5.2 Description The CM Business Directory plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'cmbd featured image' shortcode. This is due to...

PT-2025-39514

Name of the Vulnerable Software and Affected Versions TweetThis Shortcode plugin for WordPress versions prior to 1.8.1 Description The TweetThis Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'tweetthis' shortcode. Insufficient input sanitization and outp...

PT-2025-39480

Name of the Vulnerable Software and Affected Versions Widgets for Tiktok Feed plugin for WordPress versions up to and including 1.7.3 Description The Widgets for Tiktok Feed plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'trustindex-feed' shortcode. This is due to...

PT-2025-39516

Name of the Vulnerable Software and Affected Versions Markdown Shortcode plugin for WordPress versions prior to 0.2.2 Description The Markdown Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'markdown' shortcode. Insufficient input sanitization and output...

CVE-2025-9353

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

BIT-WORDPRESS-MULTISITE-2025-58246 WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to...