CVE-2025-11821 Woocommerce – Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooproductscustomtax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVE-2025-11859 Paypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including, 0.1. This is due to the plugin not properly sanitizing user input and output of the 'title' and 'text' parameters. This makes it possibl...

CVE-2025-12671 WP-Iconics <= 0.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wpiconics' shortcode in all versions up to, and including, 0.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-12665

CVE-2025-12665 describes a vulnerability in the WordPress plugin “Ninja Countdown | Fastest Countdown Builder” (versions up to 1.5.0). The issue is a missing capability check on the ninja_countdown_admin_ajax endpoint, enabling authenticated attackers with Subscriber-level access or higher to del...

CVE-2025-12526 Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgcremove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2025-11856

CVE-2025-11856 (Eventbee Ticketing Widget, WordPress): The WordPress plugin Eventbee Ticketing Widget is vulnerable to Stored Cross-Site Scripting via the shortcode eventbeeticketwidget in all versions up to and including 1.0. Attack requires authenticated access at contributor level or higher, a...

CVE-2025-11863

CVE-2025-11863 covers My Geo Posts Free (WordPress) up to v1.2, exposing Stored XSS via the mygeo_city shortcode. The vulnerability allows authenticated users with contributor+ rights to inject scripts that run on pages. Wordfence lists the patch status as Unpatched; a Patchstack entry and PT-SEC...

CVE-2025-11873 WP BBCode <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

EUVD-2025-53530

Malicious code in level-aqua-turtle npm...

Malicious code in level-aqua-turtle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d1080c08842338178824d12a0dd1267a9d38ac725da62ac95a1df8145161273 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53525

Malicious code in level-yellow-crow npm...

MAL-2025-69119 Malicious code in level-aqua-turtle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d1080c08842338178824d12a0dd1267a9d38ac725da62ac95a1df8145161273 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53527

Malicious code in level-lavender-bobcat npm...

MAL-2025-69124 Malicious code in level-yellow-crow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edf0585845336e6aa4b90f78128dc3af918986bb33450dd034b45eabefad5e56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53526

Malicious code in level-sapphire-moose npm...

EUVD-2025-53529

Malicious code in level-bronze-bonobo npm...

EUVD-2025-53528

Malicious code in level-copper-firefly npm...

Malicious code in level-copper-firefly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29315ddbac3b0b833f90a4e6566275ffd2fe34fac89cb6d49d1c6971a469773d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46276

Name of the Vulnerable Software and Affected Versions Fleet Manager plugin for WordPress versions prior to 2.5.1 Description The Fleet Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allows...

PT-2025-46298

Name of the Vulnerable Software and Affected Versions Progress Bar Blocks for Gutenberg plugin for WordPress versions prior to 1.0.1 Description The Progress Bar Blocks for Gutenberg plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG File uploads. Insufficient input...