Vulnerabilities

TI-2025-10889 CVE-2025-11878 · GHSA-qvc2-cj8q-rq2q

ST Categories Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The ST Categories Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's st-categories shortcode in versions less than, or equal to, 1.0.0.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00193 Published 2025-10-22 No fix listed CWE-79

TI-2025-16429 CVE-2025-22543 · GHSA-w62h-vvvx-3vjw

WordPress ST Gallery WP plugin <= 1.0.8 - Settings Change vulnerability

LOW 25

Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through <= 1.0.8.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00447 Published 2025-01-07 No fix listed CWE-862

Vulnerabilities

Filters

ST Categories Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress ST Gallery WP plugin <= 1.0.8 - Settings Change vulnerability