CVE-2024-6705

CVE-2024-6705 affects the RegLevel WordPress plugin (versions up to and including 1.2.1) and enables Stored XSS via admin settings. Exploitation requires authenticated access at Administrator level or higher, and the issue specifically impacts multisite installations or sites where unfiltered_htm...

CVE-2024-6705 RegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

PT-2024-37812 · WordPress · Reglevel

Name of the Vulnerable Software and Affected Versions: RegLevel plugin for WordPress versions up to, and including, 1.2.1 Description: The issue allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages due to insufficient input...

CVE-2024-6705: Improper Neutralization of Input During Web Page Generation

The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2024-6669 AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-6669

The CVE CVE-2024-6669 affects the WPBot WordPress plugin (AI ChatBot for WordPress) up to version 5.5.7, enabling Stored Cross-Site Scripting via admin settings and requiring administrator+ privileges. Impact is limited to multisite setups or where unfiltered_html is disabled; a fix exists in ver...

CVE-2024-6669: Improper Neutralization of Input During Web Page Generation

The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-6625

The WP Total Branding – Complete branding solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-6625

CVE-2024-6625 concerns the WP Total Branding – Complete branding solution for WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in admin settings present in all versions up to 1.2, caused by insufficient input sanitization and output escaping. Attack requires authent...

CVE-2024-6625: Improper Neutralization of Input During Web Page Generation

The WP Total Branding – Complete branding solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-6225

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 and 7.5.1 for the Pro version due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2024-6225 Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 and 7.5.1 for the Pro version due to insufficient input sanitization and output escaping. This makes it possib...

PT-2024-37465

Name of the Vulnerable Software and Affected Versions: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions 1.1.5 and earlier The Booking for Appointments and Events Calendar – Amelia plugin for WordPress Pro version 7.5.1 and earlier Description: The issue is...

CVE-2024-6225: Improper Neutralization of Input During Web Page Generation

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 and 7.5.1 for the Pro version due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2023-6495

CVE-2023-6495 concerns the YARPP – Yet Another Related Posts Plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) via admin settings in all versions up to and including 5.30.9, caused by insufficient input sanitization and output escaping. It affects sites using multi-si...

CVE-2023-6495: Improper Neutralization of Input During Web Page Generation

The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-14973

Name of the Vulnerable Software and Affected Versions YARPP – Yet Another Related Posts Plugin versions up to and including 5.30.9 Description The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticat...

Tooltip CK <= 2.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Tooltip CK plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-4145

The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks such as within a multi-site network...

CVE-2024-4145 Search & Replace < 3.2.2 - Admin+ SQL injection

The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks such as within a multi-site network...