PT-2025-1690 · WordPress · Sell Media

Name of the Vulnerable Software and Affected Versions: Sell Media plugin for WordPress versions up to and including 2.5.8.5 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the sell media...

CVE-2024-11934: Improper Neutralization of Input During Web Page Generation

The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2025-1686 · WordPress · App Embed

Name of the Vulnerable Software and Affected Versions: App Embed plugin for WordPress versions up to and including 2.3.2 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'appizy'...

PT-2025-1870 · WordPress · Wp Jquery Datatable

Name of the Vulnerable Software and Affected Versions: WP jQuery DataTable plugin for WordPress versions up to, and including, 4.0.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wp jdt' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-4546 · Unknown · Smoothness Slider Shortcode

Name of the Vulnerable Software and Affected Versions: Smoothness Slider Shortcode versions n/a through v1.2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-1855 · WordPress · Chat Support For Viber

Name of the Vulnerable Software and Affected Versions: Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress versions up to, and including, 1.7.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'vchat'...

PT-2025-1657 · WordPress · Image Magnify

Name of the Vulnerable Software and Affected Versions: Image Magnify plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'image magnify' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-1856 · WordPress · Yogo Booking

Name of the Vulnerable Software and Affected Versions: YOGO Booking plugin for WordPress versions up to, and including, 1.6.2 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the yogo-calenda...

PT-2025-1885 · WordPress · Wordpress Survey & Poll

Name of the Vulnerable Software and Affected Versions: WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress versions up to 1.7.5 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on user-supplied attributes ...

PT-2025-1849 · WordPress · Marketplace Items

Name of the Vulnerable Software and Affected Versions: Marketplace Items plugin for WordPress versions up to, and including, 1.5.5 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'marketplace' shortcode. This allow...

PT-2025-1650 · WordPress · Common Ninja

Name of the Vulnerable Software and Affected Versions: Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to stored cross-site scripting due to insufficient input...

CVE-2024-12437: Improper Neutralization of Input During Web Page Generation

The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12419: Improper Control of Generation of Code

The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2024-12592: Improper Neutralization of Input During Web Page Generation

The Sellsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testSellsy' shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-1850

Name of the Vulnerable Software and Affected Versions Candifly plugin for WordPress versions 1.0.6 and earlier Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the candifly shortcode. This allows authenticated attackers with...

PT-2025-1847

Name of the Vulnerable Software and Affected Versions Marketplace Items plugin for WordPress versions up to, and including, 1.5.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'envato' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-1689

Name of the Vulnerable Software and Affected Versions Solar Wizard Lite plugin for WordPress versions 1.2.4 and earlier Description The issue is related to Stored Cross-Site Scripting via the plugin's 'solar wizard' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-11899: Improper Neutralization of Input During Web Page Generation

The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-22558: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus C. J. Hartmann mcjh button shortcode mcjh-button-shortcode allows Stored XSS.This issue affects mcjh button shortcode: from n/a through = 1.6.4...

CVE-2024-12439: Improper Neutralization of Input During Web Page Generation

The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...