CVE-2025-3076

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttontext’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-3076

CVE-2025-3076 : Elementor Website Builder Pro for WordPress is affected by a Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the button_text parameter, affecting versions up to and including 3.29.0. Exploitation requires authentication at Contributo...

CVE-2025-5568

The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-5528

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateormastodonshare parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-5239

The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘classname’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-5568

The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-9994

CVE-2024-9994 affects the WordPress plugin Essential Addons for Elementor – Pricing Table Widget. Vulnerable component: eael_pricing_item_tooltip_content; vulnerability type: Stored Cross-Site Scripting (XSS) due to insufficient input sanitization/output escaping. Affected versions: all up to 6.1...

CVE-2025-5239 Domain For Sale <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter

The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘classname’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-5536

The Freemind Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'freemind' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-5565

The CVE-2025-5565 entry concerns the WordPress plugin Hide It. It is reported as a Stored XSS vulnerability affecting all versions up to 1.0.1 via the hideit shortcode due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or hi...

CVE-2025-5538

The CVE-2025-5538 entry corresponds to a Stored Cross-Site Scripting vulnerability in the WordPress plugin BNS Featured Category, affecting all versions up to 2.8.2. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s bnsfc shortcod...

CVE-2025-5586

CVE-2025-5586 concerns the WordPress Ajax Load More and Infinite Scroll plugin. The vulnerability is a stored XSS via the id parameter in all versions up to 1.6.0. It requires authentication at Contributor level or higher to inject arbitrary scripts, which then execute in pages loaded by other us...

CVE-2025-4671

The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's usermeta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-32015

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the attribute, which leads to cross-site scripting XSS by loading an attacker's UserJS inside . In order to execute the attack, the attacker needs to control one of the victim's feeds and...

CVE-2025-4205 Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-4671

CVE-2025-4671 affects the WordPress Profile Builder plugin for WordPress, versions up to and including 3.13.8. The root cause is insufficient input sanitization and output escaping on user_meta and compare shortcodes, enabling Stored Cross-Site Scripting (XSS). Exploitation requires authenticated...

CVE-2025-4224

The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4224

CVE-2025-4224 (wpForo + wpForo Advanced Attachments) affects the WordPress plugin pair and enables Stored Cross-Site Scripting via media upload names due to insufficient input sanitization and output escaping. According to the provided documents, exploitation requires Custom-level access or highe...

CVE-2025-4224 wpForo + wpForo Advanced Attachments <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting

The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-23595 · WordPress · Wp Plugin Info Card

Name of the Vulnerable Software and Affected Versions: WP Plugin Info Card plugin for WordPress versions up to, and including, 5.3.1 Description: The issue is related to Stored Cross-Site Scripting via the containerid parameter due to insufficient input sanitization and output escaping. This allo...