Vulnerabilities

TI-2025-10881 CVE-2025-11869 · GHSA-mvpq-26f9-8xgx

Precise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Precise Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wrap_id` shortcode attribute in all versions up to, and including, 1.0.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00193 Published 2025-11-11 No fix listed CWE-79

TI-2022-02228 CVE-2022-2413 · GHSA-9r3v-3w88-2hh3

Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title

LOW 25

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0053 Published 2024-01-16 Fixed in 2.3.47 CWE-79

TI-2023-13039 CVE-2023-28499 · GHSA-r5r8-fxfq-hj6q

WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)

LOW 25

Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin <= 2.4.9 versions.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00473 Published 2023-11-07 No fix listed CWE-79

Vulnerabilities

Filters

Precise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title

WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)