PT-2025-14586 · WordPress · Big Boom Directory

Name of the Vulnerable Software and Affected Versions: Big Boom Directory plugin for WordPress versions up to, and including, 2.5.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'bbd-search' shortcode. This allow...

CVE-2025-2483

The Gift Certificate Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘receipaddress’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-2906

The CVE-2025-2906 entry is tied to Contempo Real Estate Core, a WordPress plugin. It describes a Stored Cross-Site Scripting vulnerability in versions up to 3.6.3 due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. An authenticated attacker with contr...

CVE-2025-2906 Contempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-1512

The PowerPack Elementor Addons Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-11180

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekitcountdowntimertitle parameter in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-2804 tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'accountid' and 'accountusername' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-58130

In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses...

CVE-2024-58130

The CVE-2024-58130 affects MISP prior to 2.4.193 in RestResponseComponent.php where non-JSON REST responses are not sanitized. This could allow processing of non-JSON outputs through REST endpoints. Remediation: upgrade to MISP 2.4.193 (or later).

CVE-2025-2542

The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CVE-2024-12109

The Product Labels For Woocommerce Sale Badges WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-2685

The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2025-0845

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-1312

CVE-2025-1312 (Ultimate Blocks) : A stored cross-site scripting vulnerability exists in the Ultimate Blocks – WordPress Blocks Plugin, reachable by an attacker with Contributor+ privileges via the buttonTextColor parameter. Connected sources confirm this is an authenticated Stored XSS and affect ...

CVE-2025-1703

CVE-2025-1703 affects Ultimate Blocks (WordPress Blocks Plugin) up to v3.2.7. Stored XSS via the content parameter due to insufficient input sanitization/output escaping. Requires Contributor+ authentication to exploit; payloads execute when a user visits the injected page. Patch released in Ulti...

CVE-2025-2009

The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-1490

CVE-2025-1490 concerns the WordPress plugin Smart Maintenance Mode . The vulnerability is a Reflected Cross-Site Scripting via the setstatus parameter in all versions up to 1.5.2, due to insufficient input sanitization and output escaping. This could allow unauthenticated attackers to inject scri...

CVE-2025-2542 Your Simple SVG Support <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CVE-2025-1446

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-12769

The CVE-2024-12769 entry concerns the WordPress Simple Banner plugin before version 3.0.4. The underlying issue is that the plugin does not sanitize and escape some of its settings, which could allow high-privilege users (e.g., admins) to perform Stored XSS even when unfiltered_html is disallowed...