CVE-2024-13328 Giga Messenger Bots <= 2.3.1 - Reflected XSS

The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13330

The CVE-2024-13330 entry concerns the JustRows free WordPress plugin (versions up to 0.2). The flaw is a Reflected XSS caused by not sanitising/escaping a parameter before echoing it in the page, enabling an attacker to craft input that could be reflected back to high-privilege users (e.g., admin...

CVE-2024-13329 Solidres <= 0.9.4 - Reflected XSS

The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13329 Solidres <= 0.9.4 - Reflected XSS

The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13330 Justrows Free <= 0.2 - Reflected XSS

The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13328

CVE-2024-13328 affects the WordPress plugin “Giga Messenger – Express” (Giga Messenger) up to version 2.3.1. The connected documents confirm a vulnerability where a parameter is not sanitised or escaped before being echoed back on the page, resulting in a Reflected Cross-Site Scripting (XSS) vuln...

CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS

The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13327

The CVE covers the Musicbox WordPress plugin (versions 2.0.3 and earlier). A Reflected XSS occurs due to lack of sanitization and escaping of a parameter before it’s output on the page, enabling script execution in the context of high-privilege users (e.g., admins). The Nuclei template confirms t...

CVE-2024-13327 Musicbox <= 2.0.3 - Reflected XSS

The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13326

CVE-2024-13326 affects the iBuildApp WordPress plugin (versions up to 0.2.0). The issue is a reflected cross-site scripting (XSS) caused by insufficient sanitization/escaping of a parameter before echoing it to the page, enabling an attacker to trick high-privilege users (e.g., admins) into execu...

CVE-2024-13327 Musicbox <= 2.0.3 - Reflected XSS

The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS

The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13325 Glossy <= 2.3.5 - Reflected XSS

The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13114 WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS

The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13114

CVE-2024-13114 relates to the WordPress plugin “WP Projects Portfolio with Client Testimonials” (versions

PT-2025-2118 · WordPress · Transfinanz Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: TransFinanz WordPress plugin version 1.0.0 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...

PT-2025-2111

Name of the Vulnerable Software and Affected Versions Glossy WordPress plugin versions 2.3.5 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be use...

PT-2025-2116

Name of the Vulnerable Software and Affected Versions JustRows free WordPress plugin versions 0.2 and earlier Description The issue arises from the plugin not sanitising and escaping a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. This could be used...

PT-2025-2011

Name of the Vulnerable Software and Affected Versions WP Projects Portfolio with Client Testimonials WordPress plugin versions 3.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin, due to a parameter not...

CVE-2024-13099

The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...