CVE-2024-10894 Payment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'datepicker', 'textarea', and 'text' in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-10894

CVE-2024-10894 affects the WordPress plugin Payment Forms for Paystack. It is a stored XSS via shortcode attributes (datepicker, textarea, text) in all versions up to 4.0.2 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level ...

CVE-2024-10894 Payment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'datepicker', 'textarea', and 'text' in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping on user supplied attributes...

Cross-Site Scripting (XSS)

publifycore is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input sanitization in the redirect functionality, allowing a publisher to execute scripts in an administrator's browser...

WordPress plugin QR Master 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting (XSS)

Exploit Title: CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting XSS Date: 2024-08-15 Exploit Author: Raj Nandi Vendor Homepage: https://codeastro.com/ Software Link: https://codeastro.com/online-railway-reservation-system-in-php-with-source-code/ Version: 1.0 Tested on: Any ...

PT-2025-15918 · WordPress · Payment Forms For Paystack

Name of the Vulnerable Software and Affected Versions: Payment Forms for Paystack plugin for WordPress versions up to, and including, 4.0.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in th...

CVE-2025-3100

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping...

CVE-2025-3100 WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping...

CVE-2025-3100 WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping...

CVE-2025-3100

CVE-2025-3100 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the WP Project Manager plugin for WordPress. The issue arises from insufficient input sanitization and output escaping in the tasks discussion, enabling an authenticated user with Subscriber-level access (and those grant...

PT-2025-15671 · WordPress · Wp Project Manager

Name of the Vulnerable Software and Affected Versions: The WP Project Manager plugin versions up to, and including, 2.6.22 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping in tasks discussion. This...

The vulnerability of the setWebWlanIdx function in the /lib/cste_modules/wireless.so file of the TOTOLINK A3100R router’s microprogramming system, which allows a attacker to execute arbitrary commands.

The vulnerability of the setWebWlanIdx function in the /lib/cstemodules/wireless.so module of the TOTOLINK A3100R router’s microprogramming system is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a...

CVE-2025-2808

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Number parameter in all versions up to, and including, 1.4.63 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2025-2808

CVE-2025-2808: Motors – Car Dealership & Classified Listings Plugin for WordPress has a Stored XSS in the Phone Number parameter in all versions up to 1.4.63 due to insufficient input sanitization and output escaping. Exploitation requires Subscriber+ access and triggers when a user visits a page...

CVE-2025-3432

The AAWP Obfuscator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-aawp-web' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...

CVE-2024-41788

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges...

CVE-2025-3432 AAWEP Obfuscator <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting

The AAWP Obfuscator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-aawp-web' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...

CVE-2025-3432

CVE-2025-3432 corresponds to a stored Cross-Site Scripting vulnerability in the AAWP Obfuscator WordPress plugin. According to the connected information, the issue arises from insufficient input sanitization and output escaping in the data-aawp-web parameter, affecting all versions up to and incl...

CVE-2024-41788

The CVE-2024-41788 entry concerns Siemens SENTRON 7KT PAC1260 Data Manager. The issue is an OS command injection in the device’s web interface caused by input parameters in specific GET requests not being sanitized, enabling an authenticated remote attacker to execute arbitrary code with root pri...