CVE-2025-22569

The CVE-2025-22569 entry concerns a Reflected Cross-Site Scripting (XSS) in the Featured Page Widget for WordPress (plugin). The description indicates improper neutralization of input during web page generation, enabling a reflected XSS vulnerability. Affected scope is listed as Featured Page Wid...

PT-2025-4558 · Unknown · Grandslambert Featured Page Widget

The vulnerable software is grandslambert Featured Page Widget, with versions affected ranging from n/a to 2.2. The vulnerability is an improper neutralization of input during web page generation, also known as Cross-site Scripting XSS, which allows for Reflected XSS attacks. This vulnerability is...

WordPress plugin Featured Page Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2025-4507 · Unknown · Yamna Tatheer Knr Author List Widget

Name of the Vulnerable Software and Affected Versions: Yamna Tatheer KNR Author List Widget versions n/a through 3.1.1 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This can ...

WordPress plugin KNR Author List Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-3824 · Themeisle · Orbit Fox

Name of the Vulnerable Software and Affected Versions: Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.43 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Pricing Table widget due to insufficient input sanitization and output escapi...

WordPress Orbit Fox by ThemeIsle plugin <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Pricing Table Widget vulnerability discovered by Webbernaut in WordPress Plugin Orbit Fox by ThemeIsle versions = 2.10.43...

CVE-2025-22812 WordPress News Ticker Widget for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aezaz Shaikh News Ticker Widget for Elementor news-ticker-widget-for-elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/a through = 1.3.2...

CVE-2025-22812 WordPress News Ticker Widget for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aezaz Shaikh News Ticker Widget for Elementor news-ticker-widget-for-elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/a through = 1.3.2...

CVE-2024-13153

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-13153 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-13153

CVE-2024-13153 affects the Unlimited Elements For Elementor plugin for WordPress. It enables Stored XSS via multiple widgets (Image Tooltip, Notification, Simple Popup, Video Play Button, Card Carousel) in all versions up to 1.5.135 due to insufficient input sanitization/escaped output on user at...

CVE-2024-13153 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

WordPress plugin News Ticker Widget for Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-4721 · Elementor · News Ticker Widget For Elementor

Name of the Vulnerable Software and Affected Versions: News Ticker Widget for Elementor versions 1.3.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This problem affects...

PT-2025-2032 · WordPress · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.135 Description: The issue is related to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and output escaping on...

CVE-2024-9673

Piotnet Addons For Elementor (WordPress) up to version 2.4.31 contains a Stored XSS vulnerability in the Heading widget due to insufficient input sanitization. Exploitation requires authenticated users with contributor-level access or higher, enabling injection of scripts in pages that render for...

CVE-2024-12851

CVE-2024-12851 affects the Element Pack Elementor Addons Lite (Header Footer, Template Library, Dynamic Grid, Carousel, Remote Arrows) for WordPress. The vulnerability is a Stored Cross-Site Scripting via the custom_attributes parameter of the Cookie Consent Widget, present in all versions up to ...

CVE-2024-12851 Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customattributes parameter of the Cookie Consent Widget in all versions up to, and including, 5.10.14 due to...

CVE-2024-12205

The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...