CVE-2024-12495 Bootstrap Blocks for WP Editor v2 <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bootstrap Blocks for WP Editor v2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtb-bootstrap/column' block in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-9354 Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting

The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9354

The Estatik Mortgage Calculator WordPress plugin (versions up to and including 2.0.11) is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the color parameter. Root cause: insufficient input sanitization and output escaping, enabling an unauthenticated attacker to inject arbitr...

CVE-2024-9354 Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting

The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12438

The WooCommerce Digital Content Delivery incl. DRM – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'startdate’ and 'enddate' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-12073

The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slideurlvalue' parameter in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-12383

The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'bmwdisplaypvsetpage' function and insufficient input sanitization and output escaping of the...

CVE-2024-12261

The SmartEmailing.cz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'se-lists-updated' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-11369

The Store credit / Gift cards for woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'coupon', 'startdate', and 'enddate' parameters in all versions up to, and including, 1.0.49.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-12384

CVE-2024-12384 affects Binary MLM Woocommerce (WordPress) with Reflected XSS via the 'page' parameter in all versions up to 2.0. Root cause: insufficient input sanitization and output escaping. Impact: unauthenticated attackers can inject scripts into pages executed after a user clicks a crafted ...

CVE-2024-11756

CVE-2024-11756 : The WordPress plugin SweepWidget Contests, Giveaways, Photo Contests, Competitions is affected by a Stored Cross-Site Scripting in the sweepwidget shortcode through insufficient input sanitization and output escaping for user-supplied attributes in all versions up to 2.0.6. This ...

CVE-2024-12633 JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-12633 JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-12633

The CVE-2024-12633 entry for JoomSport – for Sports: Team & League, WordPress is confirmed by connected documents as a Reflected Cross-Site Scripting vulnerability via the page parameter in versions up to 5.6.17, allowing unauthenticated attackers to inject scripts on pages that a user may load. ...

CVE-2024-12438 WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site Scripting

The WooCommerce Digital Content Delivery incl. DRM – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'startdate’ and 'enddate' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-12438 WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site Scripting

The WooCommerce Digital Content Delivery incl. DRM – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'startdate’ and 'enddate' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-9702

CVE-2024-9702 : The Social Rocket – Social Sharing Plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (Stored XSS) via the plugin’s shortcodes, specifically the socialrocket-floating shortcode, in all versions up to and including 1.3.4. The vulnerability arises from insufficient ...

CVE-2024-12438

The CVE-2024-12438 entry concerns the WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket WordPress plugin, vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters. Affected versions are up to 4.74 per the CVE description; other sources also reference ve...

CVE-2024-12464

CVE-2024-12464 (Chatroll Live Chat) is a stored XSS in the Chatroll Live Chat WordPress plugin for versions up to and including 2.5.0, due to insufficient input sanitization and output escaping on shortcode attributes. Exploitation requires authenticated access at contributor level or higher, and...

CVE-2024-12439 Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode

The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...