CVE-2024-11758: Improper Neutralization of Input During Web Page Generation

The WP SPID Italia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wit...

PT-2025-1706

Name of the Vulnerable Software and Affected Versions The Grid Accordion Lite plugin for WordPress versions up to, and including, 1.5.1 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the grid accordion shortcode. This allows...

CVE-2024-12404: Improper Neutralization of Special Elements used in an SQL Command

The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2024-12505: Improper Neutralization of Input During Web Page Generation

The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tsmap' shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress plugin CF Internal Link Shortcode SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A SQL injection vulnerability exists in WordPress plug...

WordPress CF Internal Link Shortcode plugin <= 1.1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Frissi0n in WordPress Plugin CF Internal Link Shortcode versions = 1.1.0...

PT-2025-1862 · WordPress · Ai Scribe

Name of the Vulnerable Software and Affected Versions: AI Scribe plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to SQL Injection via the template id parameter of the article builder generate data shortcode. This is due to insufficient escaping on the...

PT-2025-1866 · WordPress · Files Download Delay

Name of the Vulnerable Software and Affected Versions: Files Download Delay plugin for WordPress versions up to, and including, 1.0.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the...

PT-2025-1958 · WordPress · Searchie

Name of the Vulnerable Software and Affected Versions: Searchie plugin for WordPress versions up to, and including, 1.17.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's sio embed media shortcode due to insufficient input sanitization and output escaping on...

PT-2025-1918 · WordPress · Yumpu E-Paper

Name of the Vulnerable Software and Affected Versions: Yumpu E-Paper publishing plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode due to insufficient input sanitization and output escaping ...

CVE-2024-11907: Improper Neutralization of Input During Web Page Generation

The Skyword API Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skywordiframe' shortcode in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12514: Improper Neutralization of Input During Web Page Generation

The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12621: Improper Neutralization of Input During Web Page Generation

The Yumpu E-Paper publishing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Auto iFrame plugin < 2.0 - Contributor+ XSS via Shortcode vulnerability

Contributor+ XSS via Shortcode vulnerability discovered by Bob Matyas in WordPress Plugin Auto iFrame versions 2.0...

CVE-2024-10151

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10151

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10151 Auto iFrame < 2.0 - Contributor+ XSS via Shortcode

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10151

The Auto iFrame WordPress plugin (versions prior to 2.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly validate and escape certain shortcode attributes before they are rendered on a page or post. This flaw allows users with contributor roles or higher to inject ...

CVE-2024-12030

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2025-1578 · WordPress · Auto Iframe

Name of the Vulnerable Software and Affected Versions: Auto iFrame WordPress plugin versions prior to 2.0 Description: The issue concerns the Auto iFrame WordPress plugin, where versions prior to 2.0 do not validate and escape some of its shortcode attributes before outputting them back in a page...