CVE-2025-0629 Coronavirus (COVID-19) Notice Message <= 1.1.2 - Admin+ Stored XSS

The Coronavirus COVID-19 Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2025-0629

CVE-2025-0629 affects the Coronavirus (COVID-19) Notice Message WordPress plugin (

CVE-2024-13862 S3Bubble Media Streaming <= 8.0 - Reflected XSS

The S3Bubble Media Streaming AWS|Elementor|YouTube|Vimeo Functionality WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13853 SEO Tools <= 4.0.7 - Reflected XSS

The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13862 S3Bubble Media Streaming <= 8.0 - Reflected XSS

The S3Bubble Media Streaming AWS|Elementor|YouTube|Vimeo Functionality WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13862

CVE-2024-13862 affects the WordPress plugin S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) up to version 8.0. The vulnerability is a Reflected XSS caused by insufficient sanitisation/escaping of a parameter output on the page. Impact is described as potentially targeting hig...

CVE-2024-13853 SEO Tools <= 4.0.7 - Reflected XSS

The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13836 WP Login Control <= 2.0.0 - Reflected XSS

The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13615 Social Media Plugin by Social Snap <= 1.3.6 - Admin+ Stored XSS

The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the...

CVE-2024-13615

CVE-2024-13615 affects the WordPress plugin “Social Snap” (Social Share Buttons / Social Sharing Icons / Click to Tweet) up to version 1.3.6. Public description: stored cross-site scripting (XSS) could be triggered by high-privilege admins via unsanitised/unescaped settings, even when unfiltered_...

CVE-2024-13836

CVE-2024-13836 affects the WordPress plugin WP Login Control, version ≤ 2.0.0. The vulnerability is a reflected XSS caused by insufficient sanitization/escaping of a parameter before it is echoed on the page, which could be leveraged against high-privilege users (e.g., admins). The connected docu...

CVE-2024-13836 WP Login Control <= 2.0.0 - Reflected XSS

The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13574 XV Random Quotes <= 1.40 - Reflected XSS

The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13574 XV Random Quotes <= 1.40 - Reflected XSS

The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13574

CVE-2024-13574 – XV Random Quotes (WordPress) ≤ 1.40 : The vulnerability arises from insufficient sanitization/escaping of an input parameter before echoing it in the page, causing a reflected XSS that could target high-privilege users (e.g., admins). Public details about a fix/patch version are ...

Fortinet FortiSandbox 安全漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. A security vulnerability exists in Fortinet FortiSandbox versions 4.4.0 to...

CVE-2024-13825

The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-9458

The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13668

The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2025-1363

CVE-2025-1363 affects the WordPress plugin “URL Shortener | Conversion Tracking | AB Testing | WooCommerce” (versions up to 9.0.2). The vulnerability is a Stored Cross-Site Scripting (XSS) that occurs due to insufficient sanitisation/escaping of certain plugin settings, enabling a high-privilege ...