CVE-2025-8619

The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map Block URL in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9441 iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter

The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2025-8290

CVE-2025-8290 affects the WordPress plugin List Sub Pages (List Subpages) up to version 1.0.6. The vulnerability is a Stored Cross-Site Scripting flaw in the title parameter caused by insufficient input sanitization and output escaping, allowing authenticated attackers with at least Contributor-l...

PT-2025-35188

Name of the Vulnerable Software and Affected Versions: The List Subpages plugin for WordPress versions up to and including 1.0.6 Description: The List Subpages plugin for WordPress is susceptible to Stored Cross-Site Scripting through the title parameter. Insufficient input sanitization and outpu...

PT-2025-35194

Name of the Vulnerable Software and Affected Versions: Events Addon for Elementor plugin for WordPress versions prior to 2.2.9 Description: The Events Addon for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Typewriter and Countdown widgets. Insufficient...

PT-2025-35191

Name of the Vulnerable Software and Affected Versions: iATS Online Forms plugin for WordPress versions up to and including 1.2 Description: The iATS Online Forms plugin for WordPress is susceptible to time-based SQL Injection via the order parameter. Insufficient escaping of user-supplied input a...

CVE-2025-8073

The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-6255

The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-6255 Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-6255

CVE-2025-6255 affects the WordPress plugin Dynamic AJAX Product Filters for WooCommerce . Root cause: insufficient input sanitization and output escaping in the className parameter, enabling Stored Cross‑Site Scripting . Affected versions: all up to and including 1.3.7 . Impact: authenticated att...

CVE-2025-8073 Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter

The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-8603

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-8603 Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-8603

CVE-2025-8603 affects the WordPress plugin “Unlimited Elements For Elementor” (Auth Contributor+). Root cause: insufficient input sanitization and output escaping in multiple widgets, enabling stored XSS. Impact: authenticated attackers can inject scripts that run when other users visit the injec...

CVE-2025-8603 Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-9344

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwpprofile' and 'uwpprofileheader' shortcodes in all versions up to, and including, 1.2.42 due to insufficient...

CVE-2025-9352

The Pronamic Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-9344 UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwpprofile' and 'uwpprofileheader' shortcodes in all versions up to, and including, 1.2.42 due to insufficient...

CVE-2025-9352

CVE-2025-9352 covers the Pronamic Google Maps plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) in the description field across all versions up to 2.4.1, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contr...

PT-2025-34965

Name of the Vulnerable Software and Affected Versions: Simple Download Monitor plugin for WordPress versions through 3.9.33 Description: The Simple Download Monitor plugin for WordPress is susceptible to time-based SQL Injection via the order parameter. Insufficient escaping of user-supplied inpu...