CVE-2024-11934 Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-11930

The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppmtasks shortcode in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-12814 Loan Comparison <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Loan Comparison plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'loancomparison' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11885

CVE-2024-11885 affects NinjaTeam Chat for Telegram plugin for WordPress. It is a stored cross-site scripting (XSS) in the njtele_button shortcode caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authenticated access at Contributor le...

CVE-2024-11230

CVE-2024-11230 affects Ultimate Addons for Elementor (formerly Elementor Header & Footer Builder): Stored XSS via the Page Title Widget in Elementor Header & Footer Builder versions up to 1.6.46. Exploitation requires authenticated access (Contributor+). Patch is applied; update to the fixed rele...

CVE-2024-11688 LaTeX2HTML <= 2.5.5 - Reflected Cross-Site Scripting

The LaTeX2HTML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ver' or 'date' parameter in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-11682

CVE-2024-11682 : The G Web Pro Store Locator WordPress plugin is vulnerable to a reflected Cross-Site Scripting (XSS) via the q parameter in all versions up to and including 2.1, caused by insufficient input sanitization and output escaping. This enables unauthenticated attackers to inject arbitr...

CVE-2024-11893

The Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spokibutton' shortcode in all versions up to, and including, 2.15.15 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-11806 PKT1 Centro de envios <= 1.2.1 - Reflected Cross-Site Scripting

The PKT1 Centro de envios plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'success' and 'error' parameters in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-11411 Spotlightr <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Spotlightr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12626 AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-searchfieldvalue’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitizatio...

CVE-2024-21548

Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. Note: This issue relates to the widely known and actively developed 'Bun'...

CVE-2024-11439

The ScanCircle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'scancircle' shortcode in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12513

CVE-2024-12513 is a Stored XSS in the Contests by Rewards Fuel plugin for WordPress (

CVE-2024-12395

The WooCommerce Additional Fees On Checkout Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-11905 Animated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12474

The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-11883

The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnxscriptcode' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11855

The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-12523

CVE-2024-12523 affects the States Map US WordPress plugin, allowing Stored Cross-Site Scripting via the states_map shortcode in all versions up to 2.4.2. Exploitation requires authenticated access (contributor+) and can inject scripts that run when users visit the page. The provided sources inclu...