CVE-2024-7759 PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-7759 PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-7769

The CVE-2024-7769 entry covers the ClickSold IDX WordPress plugin up to version 1.90, where a Stored Cross-Site Scripting vulnerability exists due to insufficient sanitisation/escaping of settings. This could allow high-privilege users (e.g., admins) to trigger XSS even when unfiltered_html is di...

CVE-2024-7758 Stylish Price List < 7.1.8 - Contributor+ Stored XSS

The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite set...

CVE-2024-7758 Stylish Price List < 7.1.8 - Contributor+ Stored XSS

The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite set...

CVE-2024-7769 Wordpress Clicksold IDX Plugin <= 1.90 - Admin+ XSS

The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-7758

CVE-2024-7758 — WordPress Stylish Price List plugin : The plugin before version 7.1.8 does not adequately sanitize and escape certain settings, enabling potential stored XSS for high-privilege users (contributors and above) even when the unfiltered_html capability is disallowed (e.g., in multisit...

CVE-2024-7759

The CVE-2024-7759 entry applies to the WordPress plugin “PWA for WP” (WordPress plugin) versions prior to 1.7.72. The issue is due to insufficient sanitisation/escaping of some settings, enabling Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins) even when unfiltered_...

CVE-2024-6797 DL Robots.txt <= 1.2 - Admin+ Stored XSS

The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6797

CVE-2024-6797 affects the DL Robots.txt WordPress plugin (versions ≤ 1.2). The vulnerability arises from insufficient sanitisation/escaping of certain settings, enabling Stored Cross-Site Scripting for high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). ...

CVE-2024-6798 DL Verification <= 1.2 - Admin+ Stored XSS

The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6798

CVE-2024-6798 affects DL Verification WordPress plugin (versions

CVE-2024-7556

CVE-2024-7556 affects the WordPress Simple Share plugin (

CVE-2024-6713

The CVE-2024-6713 entry applies to the WordPress PVN Auth Popup plugin, affected in versions up to 1.0.0. The vulnerability is a Stored XSS caused by insufficient sanitisation/escaping of some settings, which could enable high-privilege users (e.g., admins) to execute script even when unfiltered_...

CVE-2024-6665 kbucket < 4.1.6 - Admin+ Stored XSS

The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6665 kbucket < 4.1.6 - Admin+ Stored XSS

The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-6665

The CVE-2024-6665 entry concerns the KBucket WordPress plugin (pre-4.1.6) with insufficient sanitization/escaping of certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite). Public sources identify the affected co...

CVE-2024-6693

CVE-2024-6693 affects the wccp-pro WordPress plugin. Versions prior to 15.3 do not sanitize/escape certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). The impact is Stored XSS within admin-facing content/configs; ...