CVE-2025-8149: Improper Neutralization of Input During Web Page Generation

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-36359

Name of the Vulnerable Software and Affected Versions: SKT Addons for Elementor plugin for WordPress versions prior to 3.8 Description: The SKT Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and...

CVE-2025-8360: Improper Neutralization of Input During Web Page Generation

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets in all versions up to, and including, 1.5.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2025-36358

Name of the Vulnerable Software and Affected Versions: aThemes Addons for Elementor plugin for WordPress versions prior to 1.1.3 Description: The aThemes Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting via the Countdown widget. Insufficient input sanitizati...

CVE-2025-32317

In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-32317

In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-32317

In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-32317

A confused deputy condition in App Widget leads to a potential Information Disclosure vulnerability. This flaw allows for local information disclosure without requiring additional execution privileges or user interaction. While specific affected versions are not provided, the vulnerability is con...

CVE-2025-32317

In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-58858

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPBean WPB Image Widget wpb-image-widget allows Stored XSS.This issue affects WPB Image Widget: from n/a through = 1.1...

CVE-2025-58810

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jimmywb Simple Link List Widget simple-link-list-widget allows Stored XSS.This issue affects Simple Link List Widget: from n/a through = 0.3.2...

CVE-2025-58858 WordPress WPB Image Widget Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPBean WPB Image Widget wpb-image-widget allows Stored XSS.This issue affects WPB Image Widget: from n/a through = 1.1...

CVE-2025-58858

CVE-2025-58858 affects the WordPress plugin WPB Image Widget (versions up to 1.1). It is a stored XSS caused by improper neutralization of input during web page generation. The impact is stored script execution in pages that render the widget. No exploitation details are provided in the documents...

CVE-2025-58858 WordPress WPB Image Widget Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPBean WPB Image Widget wpb-image-widget allows Stored XSS.This issue affects WPB Image Widget: from n/a through = 1.1...

CVE-2025-58810 WordPress Simple Link List Widget Plugin <= 0.3.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jimmywb Simple Link List Widget simple-link-list-widget allows Stored XSS.This issue affects Simple Link List Widget: from n/a through = 0.3.2...

CVE-2025-58810

CVE-2025-58810 relates to the WordPress plugin Simple Link List Widget (versions

WordPress WPB Image Widget Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Mika in WordPress Plugin WPB Image Widget versions = 1.1...

WordPress Toggles Shortcode and Widget plugin <= 1.14 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Toggles Shortcode and Widget versions = 1.14...

WordPress Info Boxes Shortcode and Widget plugin <= 1.15 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Info Boxes Shortcode and Widget versions = 1.15...

WordPress OTW TinyMCE Widget plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin OTW TinyMCE Widget versions = 1.7...