CVE-2025-4590 Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisyconuitvaart' shortcode in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-4590

CVE-2025-4590 affects the Daisycon prijsvergelijkers WordPress plugin (versions up to and including 4.8.4). The issue is a Stored Cross-Site Scripting vulnerability in the plugin’s daisycon_uitvaart shortcode caused by insufficient input sanitization and output escaping on user-supplied attribute...

CVE-2025-4583

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-plugin attribute in all versions up to, and including, 6.9.0 Free and 6.8.0 Pro due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-5016

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 Free and 2.27.6 Premium due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-5016 Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 Free and 2.27.6 Premium due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-5016

CVE-2025-5016 affects Relevanssi – A Better Search for WordPress. The vulnerability is a Stored Cross-Site Scripting flaw via the Excerpt Highlights feature in all versions up to 4.24.5 (Free) and 2.27.6 (Premium), caused by insufficient input sanitization and output escaping. Result: unauthentic...

CVE-2025-5016 Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 Free and 2.27.6 Premium due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2025-23377 · WordPress · Product Subtitle For Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Subtitle for WooCommerce plugin for WordPress versions up to, and including, 1.3.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-23378 · Elementor · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Addons for Elementor versions up to, and including, 5.11.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the marker content...

PT-2025-23372 · WordPress · Daisycon Prijsvergelijkers Plugin

Name of the Vulnerable Software and Affected Versions: Daisycon prijsvergelijkers plugin for WordPress versions up to, and including, 4.8.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'daisycon uitvaart' shortcode due to insufficient input sanitization and...

PT-2025-23373 · WordPress · Fastspring Plugin

Name of the Vulnerable Software and Affected Versions: FastSpring plugin for WordPress versions up to, and including, 3.0.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on the color attribute in the...

CVE-2025-4944

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widgets in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-4944

CVE-2025-4944 covers the LA-Studio Element Kit for Elementor WordPress plugin. It is vulnerable to stored XSS in all versions up to 1.5.2 via Image Compare and Google Maps widgets due to insufficient input sanitization and output escaping on user-supplied attributes. The vulnerability allows auth...

CVE-2025-5235

The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4963

The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2025-5235 OpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5235 OpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5235

CVE-2025-5235 concerns the WordPress plugin OpenSheetMusicDisplay (versions up to and including 1.4.0). The root cause is insufficient input sanitization and output escaping of the className parameter, enabling stored cross-site scripting. Exploitation requires an attacker with Contributor-level ...

CVE-2025-5235 OpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5236

The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...