CVE-2021-24734

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2021-24729

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...

CVE-2024-9227

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2025-47518 WordPress Contact Form 7 – PayPal & Stripe Add-on <= 2.3.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on allows Stored XSS. This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through 2.3.4...

CVE-2025-46501

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in biancardi Mixcloud Embed mixcloud-embed allows Stored XSS.This issue affects Mixcloud Embed: from n/a through = 2.2.0...

CVE-2025-46480 WordPress Nepali Post Date plugin <= 5.1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Padam Shankhadev Nepali Post Date nepali-post-date allows Stored XSS.This issue affects Nepali Post Date: from n/a through = 5.1.1...

CVE-2025-46239 WordPress Theme Switcha plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS.This issue affects Theme Switcha: from n/a through = 3.4...

CVE-2025-46233 WordPress Sirv plugin <= 7.5.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sirv CDN and Image Hosting Sirv sirv allows Stored XSS.This issue affects Sirv: from n/a through = 7.5.3...

CVE-2025-39444

CVE-2025-39444 – WordPress MaxButtons plugin

PT-2025-16938 · WordPress · The Ultimate Dashboard

Name of the Vulnerable Software and Affected Versions: The Ultimate Dashboard WordPress plugin versions prior to 3.8.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly...

CVE-2024-49708 XSS in iKSORIS

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS Cross-site Scripting attacks. An attacker might trick a user into filling a form designed for setting delivery address with a malicious script, what causes the script to run in user's context. This vulnerability...

CVE-2025-32495

CVE-2025-32495 is an authenticated stored XSS in the Waymark WordPress plugin (Waymark

WordPress plugin Nepali Date Utilities 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-32129

Technical details for CVE-2025-32129 are not provided in the supplied documents. Monitor for updates from vendors and security advisories; the initial description notes a Stored XSS in Welcome Bar (

CVE-2025-31837

CVE-2025-31837 is a Stored XSS vulnerability in the WordPress plugin WP Proposals (WP Proposals). Affected: WP Proposals versions up to 2.3. The initial document does not specify a root cause, exploit vector, impact details beyond Stored XSS, or any available fix; no connected documents provide c...

CVE-2025-22648

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Plugin Devs Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor allows Stored XSS.This issue affects Blog, Posts and Category Filter for Elementor: from n/a through ...

CVE-2025-30776 WordPress Sitekit plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through = 1.8...

CVE-2025-1798

The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks...

CVE-2025-1798

CVE-2025-1798 is an unauthenticated stored XSS in Design Comuni Italia WordPress Theme prior to 1.1.2, caused by unescaped/sanitised parameters in output, enabling stored XSS. Affected: Design Comuni Italia Theme (

CVE-2024-53970

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a stored XSS vulnerability in vulnerable form fields. The issue allows a low‑privileged attacker to inject malicious scripts that execute in a victim’s browser when they visit the affected page. The CVE entry is supported by multipl...