CVE-2024-13793

The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2025-2802

The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2024-13793

CVE-2024-13793 affects Wolmart – Multi-Vendor Marketplace WooCommerce Theme for WordPress (versions

CVE-2024-13793 Wolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore

The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running...

PT-2025-20324 · WordPress · The Wolmart | Multi-Vendor Marketplace Woocommerce Theme

Name of the Vulnerable Software and Affected Versions: Wolmart | Multi-Vendor Marketplace WooCommerce Theme versions 1.8.11 and earlier Description: The issue is related to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a valu...

CVE-2024-13793: Improper Control of Generation of Code

The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running...

WordPress plugin Wolmart has a code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress Wolmart theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Lucio Sá in WordPress Theme Wolmart versions = 1.8.11...

CVE-2025-4055

CVE-2025-4055 affects the WordPress plugin Multiple Post Type Order (versions up to and including 1.10.0). It is a Stored Cross-Site Scripting flaw in the mpto shortcode caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authenticated ...

CVE-2025-4171: Improper Neutralization of Input During Web Page Generation

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2025-4220: Improper Neutralization of Input During Web Page Generation

The Xavin's List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-4055: Improper Neutralization of Input During Web Page Generation

The Multiple Post Type Order plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-2802

The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2025-2802 LayoutBoxx <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution

The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2025-2802 LayoutBoxx <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution

The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2025-2802

CVE-2025-2802 (LayoutBoxx) : The WordPress LayoutBoxx plugin (versions ≤ 0.3.1) is vulnerable to unauthenticated arbitrary shortcode execution due to improper validation before do_shortcode. Reported CVSSv3.1 base score 7.3 (HIGH). Patch status in provided docs is Unpatched; no fix version is giv...

CVE-2025-2802: Improper Control of Generation of Code

The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

WordPress plugin Xavins List Subpages: Cross-site Scripting Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

PT-2025-19832 · WordPress · Layoutboxx

Name of the Vulnerable Software and Affected Versions: LayoutBoxx plugin for WordPress versions up to and including 0.3.1 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do shortcode. This...

CVE-2024-13738

The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.6.65. This is due to the software allowing users to execute an action that does not properly validate a value before running...