Themepoints
Monthly
Stored cross-site scripting (CWE-79) in the Themepoints 'Logo Showcase' WordPress plugin, affecting all versions through 4.0.4, allows an authenticated low-privileged user to persist malicious script into a logo showcase entry that executes in the browser of any user who later views the rendered page. Because the input is stored rather than reflected, a single submission can fire against administrators or site visitors repeatedly, and the CVSS:3.1 vector (PR:L, UI:R, S:C) confirms that exploitation requires at least a contributor/author-level account on the WordPress site plus victim interaction with the poisoned page. Per Patchstack's report, no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); the plugin's limited install base and the need for a content-submission account keep practical risk moderate rather than critical.
Stored Cross-Site Scripting in the Accordion WordPress plugin (versions <= 3.0.6) allows authenticated subscriber-level users to inject malicious JavaScript into accordion content fields, which then executes in the browser of any higher-privileged user who views the affected page. The scope change (S:C in CVSS) confirms the attack pivots from the subscriber's input to the victim's browsing session, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and subscriber-level access requirement make this a realistic threat on sites with open user registration.
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including, 4.0.1 due to insufficient input. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Tab Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3 due to insufficient input sanitization and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcpaccordion' shortcode in all versions up to, and including, 2.6 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting (CWE-79) in the Themepoints 'Logo Showcase' WordPress plugin, affecting all versions through 4.0.4, allows an authenticated low-privileged user to persist malicious script into a logo showcase entry that executes in the browser of any user who later views the rendered page. Because the input is stored rather than reflected, a single submission can fire against administrators or site visitors repeatedly, and the CVSS:3.1 vector (PR:L, UI:R, S:C) confirms that exploitation requires at least a contributor/author-level account on the WordPress site plus victim interaction with the poisoned page. Per Patchstack's report, no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); the plugin's limited install base and the need for a content-submission account keep practical risk moderate rather than critical.
Stored Cross-Site Scripting in the Accordion WordPress plugin (versions <= 3.0.6) allows authenticated subscriber-level users to inject malicious JavaScript into accordion content fields, which then executes in the browser of any higher-privileged user who views the affected page. The scope change (S:C in CVSS) confirms the attack pivots from the subscriber's input to the victim's browsing session, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and subscriber-level access requirement make this a realistic threat on sites with open user registration.
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including, 4.0.1 due to insufficient input. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Tab Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3 due to insufficient input sanitization and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcpaccordion' shortcode in all versions up to, and including, 2.6 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.