CVE-2024-13673 Big Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13673

CVE-2024-13673 affects the Big Boom Directory plugin for WordPress. It is a Stored XSS via the plugin's bbd-search shortcode in all versions up to 2.5.0, caused by insufficient input sanitization and output escaping. Authenticated users with contributor-level access can inject scripts that execut...

CVE-2025-1663: Improper Neutralization of Input During Web Page Generation

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-30434

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.4 and iPadOS 18.4. Processing a maliciously crafted file may lead to a cross site scripting attack...

CVE-2025-2483

The Gift Certificate Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘receipaddress’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-2513

The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access...

CVE-2025-2483

CVE-2025-2483 affects the Gift Certificate Creator plugin for WordPress. It allows a Reflected Cross-Site Scripting (XSS) via the receip_address parameter in all versions up to 1.1.0. The issue enables unauthenticated attackers to inject arbitrary scripts into pages that execute when a user perfo...

CVE-2025-2483 Gift Certificate Creator <= 1.1.0 - Reflected Cross-Site Scripting via receip_address Parameter

The Gift Certificate Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘receipaddress’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-3098

CVE-2025-3098 concerns the Video Url WordPress plugin. It is a Reflected Cross-Site Scripting flaw via the id parameter in all versions up to and including 1.0.0.3, caused by insufficient input sanitization and output escaping. The impact is that unauthenticated attackers could inject script into...

CVE-2025-2513

CVE-2025-2513 concerns the WordPress plugin Smart Icons For WordPress. The connected Wordfence entry confirms a Stored Cross-Site Scripting (XSS) flaw via SVG file uploads in all versions up to 1.0.4, caused by insufficient input sanitization and lack of proper output escaping. The impact is that...

CVE-2025-2513 Smart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access...

CVE-2025-0613

The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed...

PT-2025-14476 · WordPress · Video Url Plugin

Name of the Vulnerable Software and Affected Versions: Video Url plugin for WordPress versions up to, and including, 1.0.0.3 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to...

PT-2025-14473 · WordPress · Smart Icons For Wordpress

Name of the Vulnerable Software and Affected Versions: The Smart Icons For WordPress plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029

This module enables you to obfuscate email addresses, to avoid them being easily available to spammers. The module doesn't sufficiently sanitise input when ROT13 encoding is used. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to enter specific HTML...

CVE-2025-2906

The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-2906

The CVE-2025-2906 entry is tied to Contempo Real Estate Core, a WordPress plugin. It describes a Stored Cross-Site Scripting vulnerability in versions up to 3.6.3 due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. An authenticated attacker with contr...

CVE-2025-2906 Contempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-2906 Contempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-12189

The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This...