CVE-2021-24594: Improper Neutralization of Input During Web Page Generation

The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24616: Improper Neutralization of Input During Web Page Generation

The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16122

Name of the Vulnerable Software and Affected Versions Storefront Footer Text WordPress plugin versions prior to 1.0.2 Description The issue allows high privilege users to perform Cross-Site Scripting attacks. This is due to the lack of sanitization and escaping of the Footer Credit Text added to...

CVE-2021-24646: Improper Neutralization of Input During Web Page Generation

The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16209

Name of the Vulnerable Software and Affected Versions The Qwizcards – online quizzes and flashcards WordPress plugin versions prior to 3.62 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to improper sanitization and escaping of some settings, even wh...

PT-2021-16163

Name of the Vulnerable Software and Affected Versions Booking.com Banner Creator WordPress plugin versions prior to 1.4.3 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to improper input sanitization when creating banners, even when the unfiltered ht...

CVE-2021-24706: Improper Neutralization of Input During Web Page Generation

The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24708: Improper Neutralization of Input During Web Page Generation

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16109

Name of the Vulnerable Software and Affected Versions Translate WordPress – Google Language Translator WordPress plugin versions prior to 6.0.12 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of some settings...

CVE-2021-24645: Improper Neutralization of Input During Web Page Generation

The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16058

Name of the Vulnerable Software and Affected Versions Similar Posts WordPress plugin versions 3.1.5 and earlier Description The issue allows high privilege users to execute arbitrary PHP code in a hardened environment, where DISALLOW FILE EDIT, DISALLOW FILE MODS, and DISALLOW UNFILTERED HTML are...

CVE-2021-24607: Improper Neutralization of Input During Web Page Generation

The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed...

CVE-2021-24813

The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24715

The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfilteredhtml capability is disallowed...

Cross site scripting

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads...

Cross site scripting

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24722

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24813

The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16218

Name of the Vulnerable Software and Affected Versions WP Sitemap Page WordPress plugin versions prior to 1.7.0 Description The issue arises from the plugin's failure to properly sanitise and escape some of its settings. This could allow high privilege users to perform Cross-Site Scripting attacks...