CVE-2025-7440

CVE-2025-7440 affects the WordPress plugin Anber Elementor Addon , with a Stored Cross-Site Scripting vulnerability in the parameter $item['button_link']['url'] in all versions up to 1.0.1. Exploitation requires authenticated access at Contributor level or higher, and an injected page can execute...

CVE-2025-7440 Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link

The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $item'buttonlink''url' parameter in all versions up to, and including, 1.0.1 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7649 Surbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Surbma | Recent Comments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'recent-comments' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-7649 Surbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Surbma | Recent Comments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'recent-comments' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-7651

CVE-2025-7651 covers the Earnware Connect WordPress plugin. It is a Stored Cross-Site Scripting vulnerability in the ew_hasrole shortcode, affecting all versions up to 1.0.73 due to insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authenticati...

CVE-2025-7651 Earnware Connect <= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Earnware Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ewhasrole' shortcode in all versions up to, and including, 1.0.74 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-6221 Embed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter

The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-6221

CVE-2025-6221 affects the WordPress plugin Embed Bokun (≤0.23). Affected component: the align parameter; vulnerability type: Stored Cross‑Site Scripting . Conditions: authenticated attackers with at least Contributor rights can inject scripts that execute when any user visits the affected page. R...

WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Elizaibots versions = 1.0.2...

WordPress Soledad theme <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'pcsmlsmartlistsh' vulnerability discovered by stealthcopter in WordPress Theme Soledad versions = 8.6.7...

WordPress Soledad theme <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout' vulnerability

Authenticated Contributor+ Local File Inclusion via 'headerlayout' vulnerability discovered by stealthcopter in WordPress Theme Soledad versions = 8.6.7...

PT-2025-33538 · WordPress · Advanced Iframe

Name of the Vulnerable Software and Affected Versions: Advanced iFrame plugin for WordPress versions prior to 2025.7 Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the additional parameter due to insufficient input sanitization and output...

PT-2025-33543 · WordPress · Gtranslate +1

Name of the Vulnerable Software and Affected Versions: gTranslate versions prior to 1.0 Description: The Translate This gTranslate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the base lang parameter due to insufficient input sanitization and output escaping. Th...

PT-2025-33524 · WordPress · Embed Bokun

Name of the Vulnerable Software and Affected Versions: Embed Bokun plugin for WordPress versions up to and including 0.23 Description: The Embed Bokun plugin for WordPress is susceptible to Stored Cross-Site Scripting via the align parameter due to insufficient input sanitization and output...

PT-2025-33535 · WordPress · Intl Datetime Calendar

Name of the Vulnerable Software and Affected Versions: Intl DateTime Calendar plugin for WordPress versions up to and including 1.0.1 Description: The Intl DateTime Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting via the date parameter due to insufficient input...

PT-2025-33525 · WordPress · Anber Elementor Addon

Name of the Vulnerable Software and Affected Versions: Anber Elementor Addon versions prior to 1.0.2 Description: The Anber Elementor Addon plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-33592 · WordPress · Soledad

Name of the Vulnerable Software and Affected Versions: Soledad theme for WordPress versions prior to 8.6.8 Description: The Soledad theme for WordPress is susceptible to Stored Cross-Site Scripting via the pcsml smartlists h parameter due to insufficient input sanitization and output escaping. Th...

PT-2025-33529 · WordPress · Earnware Connect

Name of the Vulnerable Software and Affected Versions: Earnware Connect versions prior to 1.0.74 Description: The Earnware Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew hasrole shortcode due to insufficient input sanitization and output escaping on...

PT-2025-33526 · WordPress · Anber Elementor Addon

Name of the Vulnerable Software and Affected Versions: Anber Elementor Addon versions up to and including 1.0.1 Description: The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $item'button link''url' parameter due to insufficient input sanitization...

WordPress Earnware Connect plugin <= 1.0.73 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Earnware Connect versions = 1.0.73...