CVE-2025-58814

CVE-2025-58814 describes a Stored Cross-Site Scripting (XSS) in WordPress plugin StagTools up to version 2.3.8, caused by improper input neutralization during web page generation. Public details confirm the affected software, version range (

WordPress plugin Stagtools 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-0891

The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-41868

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ram Ratan Maurya, Codestag StagTools plugin = 2.3.7 versions...

CVE-2023-41868

CVE-2023-41868 : An unauthenticated reflected XSS vulnerability affects the WordPress StagTools (Codestag) plugin = 2.3.8).

CVE-2023-41868 WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ram Ratan Maurya, Codestag StagTools plugin = 2.3.7 versions...

CVE-2023-41868 WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ram Ratan Maurya, Codestag StagTools plugin = 2.3.7 versions...

WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Stagtools Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41868 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3bb564ac29eb Credits Le Ngoc Anh Required privilege...

CVE-2023-0891

The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...