CVE-2025-10191 Big Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpostshippingstatus' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-10131

The CVE CVE-2025-10131 relates to the WordPress plugin All Social Share Options. Public details from Wordfence/NVD describe a Stored Cross-Site Scripting vulnerability via the plugin’s sc shortcode present in versions up to 1.0, caused by insufficient input sanitization and output escaping on use...

CVE-2025-8560

CVE-2025-8560 affects the WordPress FancyTabs plugin (versions up to and including 1.1.0). A stored XSS flaw exists in the title parameter due to insufficient input sanitization/escaping. Exploitation requires at least Contributor-level access; an authenticated attacker can inject scripts that ex...

CVE-2025-8566 GutenBee – Gutenberg Blocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameters in the CountUp and Google Maps Blocks in all versions up to, and including, 2.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2025-40061

Name of the Vulnerable Software and Affected Versions ZoloBlocks plugin for WordPress versions prior to 2.3.10 Description The software is susceptible to Stored Cross-Site Scripting XSS through multiple Gutenberg blocks. This is a result of inadequate input sanitization and output escaping of...

PT-2025-39940

Name of the Vulnerable Software and Affected Versions FancyTabs plugin for WordPress versions prior to 1.1.1 Description The FancyTabs plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the title parameter...

PT-2025-39941

Name of the Vulnerable Software and Affected Versions GutenBee – Gutenberg Blocks plugin for WordPress versions prior to 2.18.1 Description The GutenBee – Gutenberg Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting through parameters in the CountUp and Google Maps Blocks...

PT-2025-39929

Name of the Vulnerable Software and Affected Versions Eulerpool Research Systems plugin for WordPress versions through 4.0.1 Description The software contains a flaw due to inadequate input sanitization and output escaping on user-supplied attributes within the 'aaq' shortcode. This allows...

PT-2025-39935

Name of the Vulnerable Software and Affected Versions BP Direct Menus plugin for WordPress versions prior to 1.0.1 Description The BP Direct Menus plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'bpdm login' shortcode. Insufficient input sanitization and output...

CVE-2025-10180

The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-8200

The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-8440 Team Members <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Team Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first and last name fields in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-10180

The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-10136

The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-10180

CVE-2025-10180 affects the Markdown Shortcode WordPress plugin. Vulnerable component: the Markdown Shortcode (markdown-shortcode) in versions up to and including 0.2.1. Root cause: insufficient input sanitization and output escaping on user-supplied attributes in the markdown shortcode, enabling ...

CVE-2025-10136

CVE-2025-10136 concerns the WordPress plugin TweetThis Shortcode. The TweetThis Shortcode plugin is vulnerable to Stored Cross-Site Scripting via its tweetthis shortcode in all versions up to and including 1.8.0 due to insufficient input sanitization and output escaping on user-supplied attribute...

CVE-2025-10136 TweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-10136 TweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-10180 Markdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-9490

The Popup Maker WordPress plugin (up to version 1.20.6) is exposed to a Stored Cross-Site Scripting vulnerability via the title parameter. It requires authentication with Contributor-level access or higher to inject scripts, which can execute when any user visits the page containing the injected ...