16790 matches found
CVE-2025-0369 Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘listtag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
CVE-2025-0369
The CVE-2025-0369 issue concerns the JetEngine WordPress plugin. A Stored Cross-Site Scripting (XSS) flaw exists in the list_tag parameter, affecting all versions up to 3.6.2, due to insufficient input sanitization and output escaping. The vulnerability can be exploited by authenticated users wit...
CVE-2024-13385
CVE-2024-13385 – JSM Screenshot Machine Shortcode (WordPress) is a Stored Cross-Site Scripting vulnerability in the JSM Screenshot Machine Shortcode plugin for WordPress, affecting all versions up to 2.3.0. The issue arises from insufficient input sanitization and lack of proper output escaping o...
CVE-2024-13391
CVE-2024-13391 relates to a Stored Cross‑Site Scripting vulnerability in the WordPress plugin MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet . The flaw exists in the shortcode videowhisper_content_upload_guest and arises from insufficient input sanitization and o...
CVE-2024-13391 MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhispercontentuploadguest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input...
CVE-2024-9020 List category posts < 0.90.3 - Author+ Stored XSS
The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
PT-2025-2171 · WordPress · Utilities For Mtg
Name of the Vulnerable Software and Affected Versions: Utilities for MTG plugin for WordPress versions up to, and including, 1.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode due to insufficient input sanitization and output escaping on...
WordPress Utilities for MTG plugin <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Utilities for MTG versions = 1.4.1...
WordPress JSM Screenshot Machine Shortcode plugin <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin JSM Screenshot Machine Shortcode versions = 2.3.0...
CVE-2024-12598
The MyBookProgress by Stormhill Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘book’ parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-13386
CVE-2024-13386 is a stored XSS vulnerability in the WordPress plugin quote-post-type-plugin . According to the Red Hat advisory linked in the connected documents, all versions up to 1.2.2 are affected due to insufficient input sanitization and output escaping in the Author field. An attacker with...
WordPress Glofox Shortcodes plugin <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Glofox Shortcodes versions = 2.6...
WordPress Chamber Dashboard Business Directory plugin <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Chamber Dashboard Business Directory versions = 3.3.8...
CVE-2024-13215 Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render' function in modules/modal-popup/widgets/modal-popup.php. This makes it possible for authenticated attackers, with Contributor-level acce...
CVE-2024-12593 PDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode
The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdfdotab shortcode in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This...
CVE-2024-10775 Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...
CVE-2024-10775
The CVE CVE-2024-10775 concerns the Piotnet Addons For Elementor WordPress plugin. Affected versions include all up to 2.4.32. The root cause is insufficient restrictions in the pafe-template shortcode, enabling Information Exposure. The vulnerability allows authenticated attackers with Contribut...
CVE-2024-11870
The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress Elementor Addon Elements plugin <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup vulnerability
Authenticated Contributor+ Sensitive Information Exposure via Modal Popup vulnerability discovered by Ankit Patel in WordPress Plugin Elementor Addon Elements versions = 1.13.10...
