CVE-2024-11766 WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gsbookshowcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output...

CVE-2024-11785

CVE-2024-11785 (Integrate Firebase, WordPress) stores cross-site scripting in the Firebase integration plugin for WordPress. The vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s firebase_show shortcode, affecting all version...

CVE-2024-11871

CVE-2024-11871 is a stored XSS vulnerability in the WordPress plugin Social Media Shortcodes (versions up to 1.3.0) via the plugin’s patreon shortcode. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing an authenticated attacker with co...

CVE-2024-11757

CVE-2024-11757 affects the WordPress plugin WP GeoNames (vulnerable through the wp-geonames shortcode). The issue is Stored XSS caused by insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access (and above) to ...

CVE-2024-11781 Smart Agenda – Prise de rendez-vous en ligne <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2024-12441

The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-12156

The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11891

The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfai' shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11723

The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidxlistingssitemapranges, kvcoreidxlistingssitemappage, kvcoreidxagentprofilesitemap, or kvcoreidxagentprofile shortcode present in all versions up to, and including, 2.3....

CVE-2024-11459

The Country Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-11384

The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVE-2024-10182

The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-12441 BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting

The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-12441 BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting

The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-12156

CVE-2024-12156 affects the WordPress plugin AI Content Writer, Autoblogging, YouTube Subtitle to Article – SEO Help. The vulnerability is Reflected Cross-Site Scripting via the page parameter in all versions up to 6.1.3, caused by insufficient input sanitization and output escaping. Exploitation ...

CVE-2024-12162 Video & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scripting

The Video & Photo Gallery for Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2024-12156 AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting

The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11804 Planaday API <= 11.4 - Reflected Cross-Site Scripting

The Planaday API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 11.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2024-11459

CVE-2024-11459 affects the Country Blocker WordPress plugin. Public description: Reflected Cross-Site Scripting via the ip parameter in all versions up to and including 3.2 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject scripts into pag...

CVE-2024-11804

CVE-2024-11804 : Planaday API plugin for WordPress is vulnerable to Reflected Cross‑Site Scripting via the 'tab' parameter in all versions up to 11.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts into pages that execu...