PT-2025-6577 · WordPress · Zigaform – Price Calculator & Cost Estimation Form Builder

Name of the Vulnerable Software and Affected Versions: Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress versions up to, and including, 7.4.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'zgfm fvar' shortcode due to...

PT-2025-6555 · WordPress · Wp-Formassembly

Name of the Vulnerable Software and Affected Versions: WP-FormAssembly plugin for WordPress versions up to, and including, 2.0.11 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode due to insufficient input sanitization and output escaping o...

CVE-2024-13464: Improper Neutralization of Input During Web Page Generation

The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all versions up to, and including, 5.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-6576

Name of the Vulnerable Software and Affected Versions Simple Pricing Tables For WPBakery Page Builder plugin for WordPress versions up to, and including, 1.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'wdo simple pricing table free' shortcode due to...

CVE-2024-13689: Improper Control of Generation of Code

The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2024-13579: Improper Neutralization of Input During Web Page Generation

The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pollspopup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-6572 · WordPress · Cats Job Listings

Name of the Vulnerable Software and Affected Versions: CATS Job Listings plugin for WordPress versions up to and including 2.0.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-6578 · WordPress · Simplebooklet Pdf Viewer/Embedder

Name of the Vulnerable Software and Affected Versions: Simplebooklet PDF Viewer and Embedder plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode due to insufficient input sanitization...

PT-2025-6575 · WordPress · Simple Charts

Name of the Vulnerable Software and Affected Versions: Simple Charts plugin for WordPress versions up to, and including, 1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the simple chart shortcode. This allows authenticated...

PT-2025-6548

Name of the Vulnerable Software and Affected Versions Library Bookshelves plugin for WordPress versions up to, and including, 5.9 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'bookshelf' shortcode. This allows...

CVE-2024-13797: Improper Control of Generation of Code

The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running...

PT-2025-6573

Name of the Vulnerable Software and Affected Versions WP-BibTeX plugin for WordPress versions up to, and including, 3.0.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode due to insufficient input sanitization and output escaping on user-suppli...

PT-2025-6579

Name of the Vulnerable Software and Affected Versions Simple Signup Form plugin for WordPress versions up to, and including, 1.6.5 Description The issue is related to SQL Injection via the id attribute of the ssf shortcode. This is due to insufficient escaping on the user-supplied parameter and...

CVE-2024-13588: Improper Neutralization of Input During Web Page Generation

The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13577: Improper Neutralization of Input During Web Page Generation

The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13576: Improper Neutralization of Input During Web Page Generation

The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13501: Improper Neutralization of Input During Web Page Generation

The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-6613

Name of the Vulnerable Software and Affected Versions PressMart - Modern Elementor WooCommerce WordPress Theme versions 1.2.16 and earlier Description The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software permitting users to execute an action without...

CVE-2025-0805: Improper Neutralization of Input During Web Page Generation

The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

CVE-2024-13595: Improper Neutralization of Special Elements used in an SQL Command

The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including, 1.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...