CVE-2023-5934 Travelpayouts < 1.1.13 - Settings Update via CSRF

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack...

CVE-2025-1289 Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Admin+ Stored XSS

The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1033 Badgearoo <= 1.0.14 - Admin+ Stored XSS

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9879 Website File Changes < 2.1.1 - Authenticated SQL Injection

The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-9662 CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings

The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9236

The Team WordPress plugin (also referred to as Team Members Showcase ) is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 4.4.2 . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrato...

CVE-2024-9227 PowerPress Podcasting < 11.9.18 - Author+ XSS

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-8854

The Polls CP WordPress plugin (versions prior to 1.0.77 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitise and escape certain poll settings. This flaw allows high-privilege users, such as administrators, to execute malicious scripts, even in environments wh...

CVE-2024-8702 Backup Database <= 4.9 - Admin+ Stored XSS

The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8398

The Simple Nav Archives WordPress plugin, versions 2.1.3 and earlier , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings. An attacker could trick a logged-in administrator into making unauthorized changes to these se...

CVE-2024-8426

The Page Builder: Pagelayer WordPress plugin versions prior to 1.8.8 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as administrators, to perform XSS attacks even w...

CVE-2024-8031

The Secure Downloads WordPress plugin versions prior to 1.2.3 is vulnerable to an arbitrary file download flaw. The root cause is the plugin's failure to properly restrict which files can be downloaded by authenticated users. This allows attackers with admin-level access and above to retrieve arb...

CVE-2024-7556 Wordpress Simple Share Plugin <=0.5.3 - Admin+ XSS

The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6462 DL Yandex Metrika <= 1.2 - Admin+ Stored XSS

The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13828

The Badgearoo WordPress plugin (versions 1.0.14 and earlier ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitize and escape a parameter before outputting it back onto the page. This flaw could be exploited to target high-privi...

CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13357

The Ditty WordPress plugin, in versions prior to 3.1.52 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as authors , to perform XSS attacks, even in environmen...

CVE-2024-13382 Calculated Fields Form < 5.2.64 - Admin+ Stored XSS

The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13313

The AWeber WordPress plugin (versions 7.3.20 and earlier ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to perform XSS attacks even when the u...