CVE-2025-5533

CVE-2025-5533 affects the WordPress plugin “Knowledge Base” (Knowledge Base) and is exploited via the plugin’s kbalert shortcode . According to the sources, all versions up to and including 2.3.0 are vulnerable due to insufficient input sanitization and output escaping on user-supplied attributes...

CVE-2025-5539

The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2025-5531

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user...

CVE-2025-5532

The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user...

PT-2025-24042 · WordPress · Hide It

Name of the Vulnerable Software and Affected Versions: Hide It plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-24043 · WordPress · Ajax Load More/Infinite Scroll

Name of the Vulnerable Software and Affected Versions: Ajax Load More and Infinite Scroll plugin for WordPress versions up to, and including, 1.6.0 Description: The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. Thi...

PT-2025-24036 · WordPress · Wp Knowledgebase

Name of the Vulnerable Software and Affected Versions: Knowledge Base plugin for WordPress versions prior to 2.3.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the kbalert shortcode. This allows authenticated attackers with...

The vulnerability of the built-in server boa (/boafrm/formWsc) of the TOTOLINK X2000R router’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the built-in server boa /boafrm/formWsc of the TOTOLINK X2000R router microprogramming system is related to the lack of measures to sanitize input data during the processing of the peerRptPin parameter. Exploiting this vulnerability allows a remote attacker to execute arbitra...

Detecting and Mitigating SQL Injection Vulnerabilities in Web Applications

SQL injection SQLi remains a critical vulnerability in web applications, enabling attackers to manipulate databases through malicious inputs. Despite advancements in mitigation techniques, the evolving complexity of web applications and attack strategies continues to pose significant risks. This...

PT-2025-24038 · WordPress · Freemind Viewer

Name of the Vulnerable Software and Affected Versions: Freemind Viewer plugin for WordPress versions up to and including 1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'freemind' shortcode. This allows authenticated...

PT-2025-24040 · WordPress · Runners Log

Name of the Vulnerable Software and Affected Versions: Runners Log plugin for WordPress versions up to, and including, 3.9.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-24045 · WordPress · Developer Formatter

Name of the Vulnerable Software and Affected Versions: Developer Formatter plugin for WordPress versions up to, and including, 2015.0.2.1 Description: The issue is related to Stored Cross-Site Scripting via the Custom CSS, caused by insufficient input sanitization and output escaping. This allows...

PT-2025-24046 · WordPress · Stageshow

Name of the Vulnerable Software and Affected Versions: StageShow plugin for WordPress versions up to, and including, 10.0.3 Description: The issue is related to Stored Cross-Site Scripting via the anchor parameter due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-24074 · WordPress · Domain For Sale

Name of the Vulnerable Software and Affected Versions: The Domain For Sale plugin for WordPress versions up to, and including, 3.0.10 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers wi...

PT-2025-24044 · WordPress · Paged Gallery

Name of the Vulnerable Software and Affected Versions: Paged Gallery plugin for WordPress versions up to and including 0.7 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the gallery shortcode. This allows authenticated attacke...

PT-2025-24039 · WordPress · Bns Featured Category

Name of the Vulnerable Software and Affected Versions: BNS Featured Category plugin for WordPress versions up to, and including, 2.8.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode due to insufficient input sanitization and output escaping on...

CVE-2025-4671

The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's usermeta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5340

The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘albumbuyurl’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4205

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-5341

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it...