CVE-2025-8623

CVE-2025-8623 : The WeedMaps Menu for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the plugin’s weedmaps_menu shortcode in versions

CVE-2025-8623 WeedMaps Menu for WordPress <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode

The WeedMaps Menu for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's weedmapsmenu shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9852

CVE-2025-9852 : Yoga Schedule Momoyoga WordPress plugin versions

CVE-2025-9852 Yoga Schedule Momoyoga <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Yoga Schedule Momoyoga plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'momoyoga-schedule' shortcode in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2025-10131 All Social Share Options <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-10130

CVE-2025-10130 concerns the WordPress Layers plugin (vulnerable versions:

CVE-2025-10130 Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2025-10130 Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2025-10179 My AskAI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2025-10179 My AskAI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

PT-2025-39934

Name of the Vulnerable Software and Affected Versions dbview plugin for WordPress versions prior to 0.5.6 Description The dbview plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'dbview' shortcode. Insufficient input sanitization and output escaping on user-supplied...

PT-2025-39929

Name of the Vulnerable Software and Affected Versions Eulerpool Research Systems plugin for WordPress versions through 4.0.1 Description The software contains a flaw due to inadequate input sanitization and output escaping on user-supplied attributes within the 'aaq' shortcode. This allows...

PT-2025-39948

Name of the Vulnerable Software and Affected Versions Yoga Schedule Momoyoga plugin for WordPress versions prior to 2.9.1 Description The Yoga Schedule Momoyoga plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'momoyoga-schedule' shortcode. Insufficient input...

WordPress plugin Eulerpool Research Systems 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Eulerpool Research Systems plugin that stems from a lack of valid filtering and escaping of the aaq shortcode, which...

PT-2025-39933

Name of the Vulnerable Software and Affected Versions My AskAI plugin for WordPress versions prior to 1.0.1 Description The My AskAI plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'myaskai' shortcode. This is caused by inadequate input sanitization and output...

PT-2025-39936

Name of the Vulnerable Software and Affected Versions The Big Post Shipping for WooCommerce plugin versions prior to 2.1.2 Description The software is susceptible to Stored Cross-Site Scripting through the 'wooboigpost shipping status' shortcode. Insufficient input sanitization and output escapin...

PT-2025-39935

Name of the Vulnerable Software and Affected Versions BP Direct Menus plugin for WordPress versions prior to 1.0.1 Description The BP Direct Menus plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'bpdm login' shortcode. Insufficient input sanitization and output...

PT-2025-39937

Name of the Vulnerable Software and Affected Versions Survey Anyplace plugin for WordPress versions prior to 1.0.1 Description The software contains a Stored Cross-Site Scripting issue stemming from insufficient input sanitization and output escaping on user-supplied attributes within the...

PT-2025-39930

Name of the Vulnerable Software and Affected Versions Layers plugin for WordPress versions prior to 0.6 Description The Layers plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'webcam' shortcode. This is due to inadequate input sanitization and output escaping of...

PT-2025-39955

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.1.94 Description The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is...