CVE-2025-2009 Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting

The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-1784

CVE-2025-1784 affects Spectra Gutenberg Blocks – Website Builder for the Block Editor. The Red Hat advisory confirms a Stored Cross-Site Scripting vulnerability in the uagb block for all versions up to 2.19.0, caused by insufficient input sanitization and output escaping. Exploitation requires au...

Path Traversal

agentscope is vulnerable to Path Traversal. The vulnerability is due to improper input sanitization, where the /api/file endpoint does not properly validate the path parameter, allowing an attacker to traverse directories and access arbitrary files on the server...

CVE-2025-2573

The Amazing service box Addons For WPBakery Page Builder formerly Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2025-2576

The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2025-2165

The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2025-1490

The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-2165

CVE-2025-2165 affects the WordPress plugin SH Email Alert. The vulnerability is a reflected Cross-Site Scripting (XSS) via the mid parameter in all versions up to 1.0. It arises from insufficient input sanitization and output escaping, enabling an unauthenticated attacker to lure a user into perf...

CVE-2025-1490 Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter

The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-2165 SH Email Alert <= 1.0 - Reflected Cross-Site Scripting

The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2025-2165 SH Email Alert <= 1.0 - Reflected Cross-Site Scripting

The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2025-1490

CVE-2025-1490 concerns the WordPress plugin Smart Maintenance Mode . The vulnerability is a Reflected Cross-Site Scripting via the setstatus parameter in all versions up to 1.5.2, due to insufficient input sanitization and output escaping. This could allow unauthenticated attackers to inject scri...

CVE-2025-1490 Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter

The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-2576 Ayyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2025-2573 Amazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Amazing service box Addons For WPBakery Page Builder formerly Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2025-2576

CVE-2025-2576 pertains to the Ayyash Studio — The kick-start kit plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) via SVG file uploads in all versions up to 1.0.3, caused by insufficient input sanitization and output escaping. It requires an authenticated attacker wi...

CVE-2025-2576 Ayyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2025-2573

CVE-2025-2573: Stored XSS in Amazing service box Addons For WPBakery Page Builder (WordPress) via SVG uploads; affects all versions

CVE-2025-2302

The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's awssearchterms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-12869 · WordPress · Advanced Iframe

Name of the Vulnerable Software and Affected Versions: Advanced iFrame plugin for WordPress versions up to and including 2024.5 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the advanced iframe shortcode. This allows...