CVE-2024-12452

The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeoevent' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-13648

The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-1410

The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13674

The Cosmic Blocks 40+ Content Editor Blocks Collection plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cwpsocialshare' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2025-1407

The AMO Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's amoteamskills shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13672

The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied...

PT-2025-7515 · WordPress · Wp-Appbox

Name of the Vulnerable Software and Affected Versions: WP-Appbox plugin for WordPress versions up to, and including, 4.5.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's appbox shortcode due to insufficient input sanitization and output escaping on user-supplied...

CVE-2024-13672: Improper Neutralization of Input During Web Page Generation

The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied...

PT-2025-7377 · WordPress · The Mini Course Generator

Name of the Vulnerable Software and Affected Versions: The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress versions up to, and including, 1.0.5 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and outpu...

CVE-2024-13648: Improper Neutralization of Input During Web Page Generation

The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-7347 · WordPress · Tcbd Tooltip

Name of the Vulnerable Software and Affected Versions: TCBD Tooltip plugin for WordPress versions up to, and including, 1.0 Description: The TCBD Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tcbdtooltip text shortcode due to insufficient input...

CVE-2024-12452: Improper Neutralization of Input During Web Page Generation

The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeoevent' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2025-1489: Improper Neutralization of Input During Web Page Generation

The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

PT-2025-7503

Name of the Vulnerable Software and Affected Versions Newpost Catch plugin for WordPress versions up to, and including, 1.3.19 Description The issue is related to Stored Cross-Site Scripting via the plugin's npc shortcode due to insufficient input sanitization and output escaping on user-supplied...

CVE-2025-1406: Improper Neutralization of Input During Web Page Generation

The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, and including, 1.3.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2025-1410: Improper Neutralization of Input During Web Page Generation

The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress WP-Appbox plugin <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via appbox Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin WP-Appbox versions = 4.5.4...

WordPress Pie Calendar plugin <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via piecal Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Pie Calendar versions = 1.2.5...

WordPress Newpost Catch plugin <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via npc Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Newpost Catch versions = 1.3.19...

CVE-2024-13689

The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...