CVE-2025-12589

The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possibl...

EUVD-2020-19428

Malware in sbrugna...

EUVD-2024-16684

Malicious code in bioql PyPI...

CVE-2024-0973

The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-2869

The Easy Property Listings WordPress plugin, in versions prior to 3.5.4 , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to ...