CVE-2025-0507

The CVE-2025-0507 entry affects the WordPress plugin Ticketmeo – Sell Tickets – Event Ticketing (versions up to and including 2.3.6). It describes a Stored Cross‑Site Scripting vulnerability via the plugin’s shortcodes caused by insufficient input sanitization and output escaping on user-supplied...

CVE-2025-0507 Ticketmeo – Sell Tickets – Event Ticketing <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-13463

The SeatReg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'seatreg' shortcode in all versions up to, and including, 1.56.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2025-0470 Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-0470 Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13463

CVE-2024-13463 concerns the WordPress SeatReg plugin, where versions up to and including 1.56.0 are vulnerable to stored cross‑site scripting via the plugin’s seatreg shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authentica...

CVE-2024-13767

The Live2DWebCanvas plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ClearFiles function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2024-13396 Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionlessform' shortcodes in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13397

CVE-2024-13397 affects the WordPress plugin WPRadio – WordPress Radio Streaming Plugin up to version 1.0.4. It enables Stored Cross-Site Scripting via the plugin’s shortcodes (notably the wpradio_player shortcode) due to insufficient input sanitization and output escaping on user-supplied attribu...

CVE-2024-13396

CVE-2024-13396 : The Frictionless plugin for WordPress is vulnerable to a stored XSS via the plugin’s frictionless_form shortcode. Affected versions: up to and including 0.0.23. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes, enabling authenti...

CVE-2024-13399

Summary (CVE-2024-13399): Gosign – Posts Slider Block (WordPress) is vulnerable to stored XSS via the posts-slider-block block in all versions up to and including 1.1.0. An attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user loads the affected pa...

CVE-2024-13399 Gosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Gosign – Posts Slider Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posts-slider-block' block in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-13399 Gosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Gosign – Posts Slider Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posts-slider-block' block in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-1732 · WordPress · The Post Form – Registration Form – Profile Form For User Profiles – Frontend Content Forms For User Submissions

Name of the Vulnerable Software and Affected Versions: The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress versions up to, and including, 2.8.13 Description: The issue is related to Stored Cross-Site Scripting v...

PT-2025-2153 · WordPress · Wpradio

Name of the Vulnerable Software and Affected Versions: WPRadio – WordPress Radio Streaming Plugin versions up to, and including, 1.0.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wpradio player shortcode. This allows...

CVE-2024-13705

The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 9.8.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVE-2024-13715

The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstoreclearcache function in all versions up to, and including, 3.311. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-13705

The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 9.8.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVE-2024-13652

The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clearecpaydebuglog' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13671

The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the readscorefile function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...