CVE-2024-13590

The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress plugin Simple Shortcode Buttons: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2024-13499: Improper Control of Generation of Code

The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipressdoshortcode function in all versions up to, and including, 7.2.1. This is due to the software allowing users to...

CVE-2024-13495: Improper Control of Generation of Code

The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipressajaxgetlogs function in all versions up to, and including, 7.2.1. This is due to the software allowing users to...

PT-2025-2225 · WordPress · Ketchup Shortcodes

Name of the Vulnerable Software and Affected Versions: Ketchup Shortcodes plugin for WordPress versions up to, and including, 0.1.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode due to insufficient input sanitization and output escaping on...

CVE-2025-23449: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in davidpuc Simple shortcode buttons simple-shortcode-buttons allows Reflected XSS.This issue affects Simple shortcode buttons: from n/a through = 1.3.2...

WordPress plugin GamiPress has a code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

PT-2025-4884

Name of the Vulnerable Software and Affected Versions NotFound Simple shortcode buttons versions 1.3.2 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject...

PT-2025-2223 · WordPress · The Picture Gallery – Frontend Image Uploads

Name of the Vulnerable Software and Affected Versions: Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress versions up to, and including, 1.5.19 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'videowhisper pictures' shortcode due to...

PT-2025-1864 · WordPress · Avada Builder

Name of the Vulnerable Software and Affected Versions: Avada Builder plugin for WordPress versions up to, and including, 3.11.11 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcodes. This allows authenticated...

CVE-2024-13590: Improper Neutralization of Input During Web Page Generation

The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-2133

Name of the Vulnerable Software and Affected Versions AI Power: Complete AI Pack plugin for WordPress versions up to, and including, 1.8.96 Description The issue is related to a missing capability check on the wpaicg save image media function. This allows authenticated attackers with...

PT-2025-2189 · WordPress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress versions up to, and including, 7.2.1 Description: The issue arises due to the software allowing users to execute an action that does not properly...

WordPress GamiPress plugin <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function vulnerability

Unauthenticated Arbitrary Shortcode Execution via gamipressajaxgetlogs Function vulnerability discovered by mikemyers in WordPress Plugin GamiPress versions = 7.2.1...

WordPress AI Power: Complete AI Pack plugin <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Plugin GPT3 AI Content Writer versions = 1.8.96...

CVE-2025-22276

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in enguerranws Related Post Shortcode related-post-shortcode allows Stored XSS.This issue affects Related Post Shortcode: from n/a through = 1.2...

CVE-2025-22267

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-themes-shortcode-compatibility allows Stored XSS.This issue affects Weaver Themes Shortcode Compatibility: from n/a through = 1.0.4...

CVE-2025-22267 WordPress Weaver Themes Shortcode Compatibility Plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bruce Wampler Weaver Themes Shortcode Compatibility allows Stored XSS. This issue affects Weaver Themes Shortcode Compatibility: from n/a through 1.0.4...

CVE-2025-22276

CVE-2025-22276 is a stored XSS vulnerability in the WordPress Related Post Shortcode plugin. Affected: Related Post Shortcode (versions up to 1.2, n/a through 1.2). Root cause: improper neutralization of input during web page generation. Impact: stored cross-site scripting vulnerability with low–...

PT-2025-4406

Name of the Vulnerable Software and Affected Versions Enguerran Weiss Related Post Shortcode versions n/a through 1.2 Description The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Stored XSS. Recommendations...