CVE-2025-13853

The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatech' parameter of the nn-tech shortcode in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-13854

The Curved Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'radius' parameter of the arctext shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-13908

The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thetooltip' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress WP Duplicate Page plugin <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Duplication vulnerability discovered by Sarawut Poolkhet MisterHelloz in WordPress Plugin WP Duplicate Page versions = 1.8...

CVE-2026-0684 CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import

The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error in the 'cpisadmininit' function's permission check. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-13393

CVE-2025-13393 (FIFU SSRF) : The WordPress Featured Image from URL (FIFU) plugin (versions ≤ 5.3.1) is vulnerable to Server-Side Request Forgery via the FIFU input URL parameter in the FIFU Elementor widget. Exploitation requires authenticated access at Contributor level or higher and Elementor p...

EUVD-2026-1844

The Featured Image from URL FIFU plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize function in the Elementor widget integration. This...

CVE-2025-14555 Countdown Timer - Widget Countdown <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdevartcountdown' shortcode in all versions up to, and including, 2.7.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress PullQuote plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Gilang - DJ in WordPress Plugin PullQuote versions = 1.0...

CVE-2023-4798

The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks...

CVE-2025-11453

CVE-2025-11453 affects the Header and Footer Scripts WordPress plugin. Root cause: insufficient input sanitization and output escaping in _inpost_head_script, enabling Stored XSS. Affected versions up to 2.2.2; Wordfence notes patching in subsequent releases (2.3.0+). Impact: authenticated attack...

CVE-2025-13908

CVE-2025-13908 is a stored XSS vulnerability in the WordPress plugin The Tooltip, affecting versions up to and including 1.0.2. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s the_tooltip shortcode. The Wordfence Intelligence e...

CVE-2025-13862 Menu Card <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Menu Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category parameter in all versions up to, and including, 0.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-13897

CVE-2025-13897 refers to a Stored XSS vulnerability in the WordPress plugin Client Testimonial Slider . The flaw exists in the aft_testimonial_meta_name field within the Client Information metabox, where input is not properly sanitized or output escaped across all versions up to 2.0. The conseque...

CVE-2025-13854 Curved Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Curved Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'radius' parameter of the arctext shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-13854

CVE-2025-13854 — The Curved Text WordPress plugin is vulnerable to a stored XSS via the radius parameter of the arctext shortcode in versions up to 0.1. The Wordfence note confirms the issue arises from insufficient input sanitization/output escaping, enabling authenticated attackers with Contrib...

CVE-2025-13852 Debt.com Business in a Box <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Debt.com Business in a Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configuration' parameter of the leadform shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-13852

CVE-2025-13852 : Debt.com Business in a Box (WordPress) is vulnerable to Stored XSS via the configuration parameter of the lead_form shortcode in all versions up to 4.1.0. Root cause: insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contributor le...

CVE-2025-13967

CVE-2025-13967 (Woodpecker for WordPress) details (from connected doc): The Woodpecker for WordPress plugin is affected by a stored XSS in the woodpecker-connector shortcode’s form_name parameter. This vulnerability exists in all versions up to and including 3.0.4. Exploitation requires authentic...

CVE-2025-13903 PullQuote <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The PullQuote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pullquote' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...