CVE-2024-13585 Ajax Search Lite < 4.12.5 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress plugin Ajax Search Lite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-27016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1...

CVE-2024-13540

The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodtgetallorders.php file being publicly accessible and generating a publicly visible error...

CVE-2024-13625

The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-27016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1...

CVE-2025-27016

CVE-2025-27016 affects Drivr Lite – Google Drive Plugin (WordPress). The Wordfence, EUVD and CVE records note an Authenticated Stored Cross-Site Scripting vulnerability in Drivr Lite up to version 1.0.1, caused by improper neutralization of input during web page generation. Impact is stored XSS p...

WordPress Drivr Lite – Google Drive Plugin plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin Drivr Lite – Google Drive Plugin versions = 1.0.1...

CVE-2024-13540

The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodtgetallorders.php file being publicly accessible and generating a publicly visible error...

CVE-2024-13540

The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodtgetallorders.php file being publicly accessible and generating a publicly visible error...

CVE-2024-13540 WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure

The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodtgetallorders.php file being publicly accessible and generating a publicly visible error...

CVE-2024-13540 WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure

The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodtgetallorders.php file being publicly accessible and generating a publicly visible error...

CVE-2024-13540

CVE-2024-13540 (WooODT Lite – Delivery & pickup date time location for WooCommerce) is associated with a Full Path Disclosure vulnerability. The connected Wordfence entry notes that versions up to 2.5.1 expose the file /inc/bycwooodt_get_all_orders.php publicly, enabling unauthenticated disclosur...

WordPress plugin WooODT Lite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Drivr Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

WordPress Affiliate Links plugin <= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection vulnerability

Missing Authorization to Unauthenticated Import/Export and PHP Object Injection vulnerability discovered by Lucio Sá in WordPress Plugin Affiliate Links Lite versions = 3.0.1...

WordPress WooODT Lite plugin <= 2.5.1 - Unauthenticated Full Path Dsiclosure vulnerability

Unauthenticated Full Path Dsiclosure vulnerability discovered by stealthcopter in WordPress Plugin WooODT Lite versions = 2.5.1...

CVE-2024-13625

The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13625

The CVE-2024-13625 entry affects the Tube Video Ads Lite WordPress plugin (versions up to 1.5.7). The vulnerability is a Reflected Cross-Site Scripting caused by insufficient sanitization/escaping of an input parameter, which can be triggered in the page output and could impact high-privilege use...

CVE-2024-13625 Tube Video Ads Lite <= 1.5.7 - Reflected XSS

The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...