PT-2025-17290 · WordPress · La-Studio Element Kit For Elementor

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Table of Contents widget due to insufficient input sanitization an...

CVE-2025-39549

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Stored XSS.This issue affects Most And Least Read Posts Widget: from n/a through = 2.5.20...

CVE-2025-39549 WordPress Most And Least Read Posts Widget plugin <= 2.5.20 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Stored XSS.This issue affects Most And Least Read Posts Widget: from n/a through = 2.5.20...

CVE-2025-39549

CVE-2025-39549 describes a Stored XSS vulnerability in the WordPress plugin Most And Least Read Posts Widget . Technical detail from sources confirms the issue affects versions “n/a through 2.5.20” and arises from improper input neutralization during web page generation. Exploitation details or o...

CVE-2025-39549 WordPress Most And Least Read Posts Widget plugin <= 2.5.20 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Stored XSS.This issue affects Most And Least Read Posts Widget: from n/a through = 2.5.20...

WordPress Widget for Social Page Feeds plugin < 6.4.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Widget for Social Page Feeds versions 6.4.2...

CVE-2024-13207

The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setu...

CVE-2025-1455

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-1456

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widgetGrid, widgetCountDown, and widgetInstagramFeed methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-1455

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-16170 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1012 Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid...

CVE-2025-32500

Cross-Site Request Forgery CSRF vulnerability in Sudavar Codescar Radio Widget codescar-radio-widget allows Stored XSS.This issue affects Codescar Radio Widget: from n/a through = 0.4.2...

CVE-2025-32479

Cross-Site Request Forgery CSRF vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through = 1.0.7...

WordPress Flags Widget plugin <= 1.0.7 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin Flags Widget versions = 1.0.7...

CVE-2025-32500

Cross-Site Request Forgery CSRF vulnerability in Sudavar Codescar Radio Widget codescar-radio-widget allows Stored XSS.This issue affects Codescar Radio Widget: from n/a through = 0.4.2...

CVE-2025-32479

Cross-Site Request Forgery CSRF vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through = 1.0.7...

CVE-2025-32479 WordPress Flags Widget plugin <= 1.0.7 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ab-tools Flags Widget allows Stored XSS. This issue affects Flags Widget: from n/a through 1.0.7...

CVE-2025-32479

CVE-2025-32479 is confirmed in connected material as a CSRF-to-Stored XSS vulnerability in the Flags Widget for WordPress (affected: Flags Widget ≤ 1.0.7). The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); exploitation details are not provided in the documents. Patch status fo...

CVE-2025-32479 WordPress Flags Widget plugin <= 1.0.7 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through = 1.0.7...

CVE-2025-32500

CVE-2025-32500 : Codescar Radio Widget (versions up to 0.4.2) contains a CSRF flaw that enables Stored XSS. The issue affects the Codescar Radio Widget plugin and is currently Unpatched (no fix in the connected docs). CVSS v3.1 base score 7.1 (HIGH) according to the metrics, with network impact, ...