PT-2025-21408 · WordPress · Auto Prune Posts

Name of the Vulnerable Software and Affected Versions: Auto Prune Posts WordPress plugin versions prior to 3.0.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised an...

PT-2025-21524 · Unknown · Quiz Maker

Name of the Vulnerable Software and Affected Versions: Quiz Maker versions prior to 6.5.9.9 Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize and escape some of its...

PT-2025-21522 · WordPress · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Events Calendar WordPress plugin versions prior to 6.6.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised...

PT-2025-21457 · WordPress · Icegram Engage

Name of the Vulnerable Software and Affected Versions: Icegram Engage WordPress plugin versions prior to 3.1.32 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed...

PT-2025-21389

Name of the Vulnerable Software and Affected Versions: Advanced Schedule Posts WordPress plugin versions 2.1.8 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back...

CVE-2024-12732: Improper Neutralization of Input During Web Page Generation

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12725: Improper Neutralization of Input During Web Page Generation

The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-1286: Improper Neutralization of Input During Web Page Generation

The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12874: Improper Neutralization of Input During Web Page Generation

The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13619: Improper Neutralization of Input During Web Page Generation

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6335: Improper Neutralization of Input During Web Page Generation

The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-21452 · WordPress · Aweber Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: AWeber WordPress plugin versions 7.3.20 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2025-21378 · WordPress · The Better Follow Button For Jetpack

Name of the Vulnerable Software and Affected Versions: The Better Follow Button for Jetpack WordPress plugin versions through 8.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not...

CVE-2024-13828: Improper Neutralization of Input During Web Page Generation

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-21433 · WordPress · Clasify Classified Listing Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Clasify Classified Listing WordPress plugin versions 1.0.0 through 1.0.7 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted...

CVE-2024-9599: Improper Neutralization of Input During Web Page Generation

The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-21412 · WordPress · Real Wp Shop Lite Ajax Ecommerce Shopping Cart

Name of the Vulnerable Software and Affected Versions: Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin versions 2.0.8 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some...

PT-2025-21425 · WordPress · Panorama

Name of the Vulnerable Software and Affected Versions: Panorama WordPress plugin versions 1.5.1 and earlier Description: The issue concerns the Panorama WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as administrator...

PT-2025-21402 · WordPress · Social Media Share Buttons & Social Sharing Icons

Name of the Vulnerable Software and Affected Versions: Social Media Share Buttons & Social Sharing Icons WordPress plugin versions prior to 2.9.1 Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some...

CVE-2024-8284: Improper Neutralization of Input During Web Page Generation

The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...