CVE-2024-13630 News List <= 1.0 - Reflected XSS

The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13630

CVE-2024-13630 concerns the NewsTicker WordPress plugin (versions up to 1.0). The description in the initial document states that a parameter is not sanitised or escaped before being output to the page, enabling a Reflected Cross-Site Scripting that could affect high-privilege users (e.g., admins...

CVE-2024-13624

CVE-2024-13624 affects the WordPress plugin WPMovieLibrary up to version 2.1.4.8. The vulnerability is a reflected Cross‑Site Scripting where the plugin does not properly sanitize/escape the affected parameter (notably the import page’s parameter, e.g., order), allowing an attacker to execute arb...

CVE-2024-13624 WPMovieLibrary <= 2.1.4.8 - Reflected XSS

The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13571 Post Timeline < 2.3.10 - Reflected XSS

The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13624 WPMovieLibrary <= 2.1.4.8 - Reflected XSS

The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13571 Post Timeline < 2.3.10 - Reflected XSS

The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13571

CVE-2024-13571 affects the Post Timeline WordPress plugin prior to version 2.3.10. The issue is a Reflected Cross-Site Scripting (XSS) caused by insufficient sanitization/escaping of a parameter before it is output on the page, which could be exploited against high-privilege users (e.g., admins)....

CVE-2024-12878 Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSS

The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12878 Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSS

The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12878

CVE-2024-12878 affects the WordPress plugin Custom Block Builder (Lazy Blocks) up to version 3.8.3. The vulnerability is a Reflected XSS caused by insufficient sanitisation/escaping of an input parameter before it is output on the page, potentially enabling an attacker to target high-privilege us...

CVE-2024-12737 WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12737 WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12737

CVE-2024-12737 : WP BASE Booking of Appointments, Services and Events (WordPress)

CVE-2024-10152

CVE-2024-10152 affects the WordPress plugin Simple Certain Time to Show Content (versions before 1.3.1). The vulnerability is a Reflected XSS caused by insufficient sanitization/escaping of an input parameter before it is echoed in the page, potentially impacting high-privilege users (e.g., admin...

CVE-2024-10152 Simple Certain Time to Show Content < 1.3.1 - Reflected XSS

The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-8680 · WordPress · Simple Catalogue

Name of the Vulnerable Software and Affected Versions: Simple catalogue WordPress plugin versions 1.0.0 through 1.0.2 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. Thi...

PT-2025-8678 · WordPress · Om Stripe Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Om Stripe WordPress plugin versions through 02.00.00 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

PT-2025-8682 · WordPress · Calendapp

Name of the Vulnerable Software and Affected Versions: CalendApp WordPress plugin versions 1.1 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

PT-2025-8671

Name of the Vulnerable Software and Affected Versions WP BASE Booking of Appointments, Services and Events WordPress plugin versions prior to 5.0.0 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped...