WordPress RSS FIlter Plugin <= 1.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin RSS Filter versions = 1.2...

CVE-2024-13119

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even wh...

CVE-2025-25160

Cross-Site Request Forgery CSRF vulnerability in Mark Barnes Style Tweaker allows Stored XSS. This issue affects Style Tweaker: from n/a through 0.11...

PT-2025-5950 · Unknown · Scriptonite Simple User Profile

Name of the Vulnerable Software and Affected Versions: Scriptonite Simple User Profile versions 1.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Scriptonite Simple User Profile. Recommendations: For versions 1.9 and earlier, updat...

PT-2025-5957 · Elbowrobo · Elbowrobo

Name of the Vulnerable Software and Affected Versions: ElbowRobo Read More Copy Link versions n/a through 1.0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-5958 · Unknown · Danillo Nunes Login-Box

Name of the Vulnerable Software and Affected Versions: Danillo Nunes Login-box versions 2.0.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2024-56267

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in html5maps Interactive UK Map interactive-uk-map allows Stored XSS.This issue affects Interactive UK Map: from n/a through = 3.4.8...

CVE-2024-49672

Cross-Site Request Forgery CSRF vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs RSVP: from n/a through = 2.0.1...

CVE-2024-54440

Cross-Site Request Forgery CSRF vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through = 1.0...

CVE-2024-48048

Cross-Site Request Forgery CSRF vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through = 1.0...

CVE-2024-53726

Cross-Site Request Forgery CSRF vulnerability in RealtyCandy.com RealtyCandy IDX Broker Extended realtycandy-idx-broker-extended allows Stored XSS.This issue affects RealtyCandy IDX Broker Extended: from n/a through = 1.5.1...

CVE-2024-53711

Cross-Site Request Forgery CSRF vulnerability in tranchesdunet Hotlink2Watermark hotlink2watermark allows Stored XSS.This issue affects Hotlink2Watermark: from n/a through = 0.3.2...

WordPress Quote Comments plugin <= 3.0.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Quote Comments versions = 3.0.0...

WordPress Simple Auto Tag plugin <= 1.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Simple Auto Tag versions = 1.1...

PT-2025-2000 · WordPress · Wp Mediatagger

Name of the Vulnerable Software and Affected Versions: WP MediaTagger WordPress plugin versions 4.1.1 and earlier Description: The issue concerns the WP MediaTagger WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page or post...

CVE-2025-23057

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

CVE-2024-13527

The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

WordPress Target Video Easy Publish plugin <= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Target Video Easy Publish versions = 3.8.3...

PT-2025-2173 · WordPress · Bilingual Linker

Name of the Vulnerable Software and Affected Versions: Bilingual Linker plugin for WordPress versions up to, and including, 2.4 Description: The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-5406 · Unknown · Reviewstap

Name of the Vulnerable Software and Affected Versions: ReviewsTap versions 1.1.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability and Stored XSS in ReviewsTap. This allows for malicious actions to be performed on behalf of a user without their...