CVE-2025-3649 LightPress Lightbox < 2.3.4 - Contributor+ Stored XSS

The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks...

CVE-2025-3878

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's saverify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-3862

Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-3878

CVE-2025-3878 | SMS Alert Order Notifications – WooCommerce (WordPress) is vulnerable to Stored Cross-Site Scripting via the plugin’s sa_verify shortcode in all versions up to 3.8.1 due to insufficient input sanitization and output escaping of user-supplied attributes. The vulnerability can be ex...

CVE-2025-2158

The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.3.5 via the Post custom fields. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-2158

CVE-2025-2158 : WordPress Review Plugin (The Ultimate Solution for Building a Review Website) is reported vulnerable to Local File Inclusion via Post custom fields in versions up to 5.3.5. Exploitation requires authenticated access at Contributor level or higher; successful exploitation could all...

CVE-2025-2944

CVE-2025-2944 affects Jeg Elementor Kit (WordPress) up to v2.6.12. Vulnerability: Stored Cross-Site Scripting via Video Button and Countdown Widgets caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access at contributor...

CVE-2025-3794

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the starttimestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping...

CVE-2025-3794

CVE-2025-3794 refers to WPForms Lite

WordPress WordPress Review Plugin plugin <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields vulnerability

Authenticated Contributor+ Local File Inclusion via Post Custom Fields vulnerability discovered by Hiroho Shimada in WordPress Plugin WordPress Review Plugin versions = 5.3.5...

CVE-2024-12120

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget displaymessagetext parameter in all versions up to, and including, 1.7.1017 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-4220

The Xavin's List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Contest Gallery plugin <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by stealthcopter in WordPress Plugin Contest Gallery versions = 26.0.6...

CVE-2025-3862

Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-3862 Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-3862 Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-3782

The Cision Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-4127

The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Price Range’ parameter in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4127

CVE-2025-4127 affects the WP SEO Structured Data Schema WordPress plugin. Versiones up to 2.7.11 are vulnerable to a Stored Cross-Site Scripting (XSS) via the Price Range parameter due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contributo...

WordPress Inline Related Posts plugin <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Inline Related Posts versions = 3.8.0...