CVE-2025-5292

The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'markercontent’ parameter in all versions up to, and including, 5.11.2 due to insufficient input...

CVE-2025-4595

The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog' block in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on the 'color' attribute. Thi...

CVE-2025-4595 FastSpring <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog' block in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on the 'color' attribute. Thi...

CVE-2025-4595 FastSpring <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog' block in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on the 'color' attribute. Thi...

CVE-2025-4595

CVE-2025-4595 (FastSpring WordPress plugin) is a Stored XSS in the color attribute of the fastspring/block-fastspringblocks-complete-product-catalog block affecting all versions up to 3.0.1. Exploitation requires authenticated access at contributor level or higher; an attacker can inject scripts ...

CVE-2025-5285 Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter

The Product Subtitle for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmlTag’ parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5285 Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter

The Product Subtitle for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmlTag’ parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5292 Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'markercontent’ parameter in all versions up to, and including, 5.11.2 due to insufficient input...

CVE-2025-5285

CVE-2025-5285 targets the WordPress plugin Product Subtitle for WooCommerce. The vulnerability is a Stored Cross-Site Scripting via the htmlTag parameter in all versions up to and including 1.3.9, exploitable by authenticated users with Contributor-level access and above to inject scripts on page...

CVE-2025-5292

CVE-2025-5292 is confirmed in the WordPress plugin Element Pack Addons for Elementor (Element Pack Addons) up to version 5.11.2. The issue is a DOM-based stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping in the marker_content parameter, exploitab...

CVE-2025-4590

CVE-2025-4590 affects the Daisycon prijsvergelijkers WordPress plugin (versions up to and including 4.8.4). The issue is a Stored Cross-Site Scripting vulnerability in the plugin’s daisycon_uitvaart shortcode caused by insufficient input sanitization and output escaping on user-supplied attribute...

CVE-2025-4590 Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisyconuitvaart' shortcode in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-4590 Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisyconuitvaart' shortcode in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-4583

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-plugin attribute in all versions up to, and including, 6.9.0 Free and 6.8.0 Pro due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-5016

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 Free and 2.27.6 Premium due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-5016 Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 Free and 2.27.6 Premium due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-5016 Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 Free and 2.27.6 Premium due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-5016

CVE-2025-5016 affects Relevanssi – A Better Search for WordPress. The vulnerability is a Stored Cross-Site Scripting flaw via the Excerpt Highlights feature in all versions up to 4.24.5 (Free) and 2.27.6 (Premium), caused by insufficient input sanitization and output escaping. Result: unauthentic...

PT-2025-23372 · WordPress · Daisycon Prijsvergelijkers Plugin

Name of the Vulnerable Software and Affected Versions: Daisycon prijsvergelijkers plugin for WordPress versions up to, and including, 4.8.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'daisycon uitvaart' shortcode due to insufficient input sanitization and...

PT-2025-23377 · WordPress · Product Subtitle For Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Subtitle for WooCommerce plugin for WordPress versions up to, and including, 1.3.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...