CVE-2024-11190

The jwp-a11y WordPress plugin (versions 4.1.7 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain settings are not properly sanitised and escaped , allowing high-privilege users, such as administrators, to perform XSS attacks. This vulnerability persi...

CVE-2024-11221

The Full Screen (Page) Background Image Slideshow WordPress plugin (versions 1.1 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability could allow high-privilege users, such as a...

CVE-2024-11266 Geocache Stat Bar Widget <= 0.911 - Admin+ Stored XSS

The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11140

The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin, in versions 2.0.8 and earlier , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape certain settings. This allows high-privilege users, such as administra...

CVE-2024-11109

The WP Google Review Slider WordPress plugin (versions prior to 15.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to execute XSS...

CVE-2024-10632

The Nokaut Offers Box WordPress plugin (versions 1.4.0 and earlier ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to execute malici...

CVE-2024-10639 Auto Prune Posts < 3.0.0- Admin+ Stored XSS

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10639

The Auto Prune Posts WordPress plugin versions prior to 3.0.0 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability can be exploited by high-privilege users, such as administrators, ev...

CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed f...

CVE-2024-10362

The Social Media Share Buttons & Social Sharing Icons WordPress plugin, in versions prior to 2.9.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as administr...

CVE-2024-10149 Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets

The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10149

The Social Slider Feed WordPress plugin versions prior to 2.2.9 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks, even in envir...

CVE-2024-10143

The MB Custom Post Types & Custom Taxonomies WordPress plugin versions prior to 2.7.7 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to execute ...

CVE-2024-10107

The Giveaways and Contests by RafflePress WordPress plugin versions prior to 1.12.17 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to execute m...

CVE-2024-10144

The Rbs Image Gallery WordPress plugin (versions prior to 3.2.22 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape certain plugin settings, which allows high-privilege users, such as contributors , to perform XSS attacks. T...

CVE-2024-10145

The Hubbub Lite WordPress plugin versions prior to 1.34.4 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitize and escape certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to perform XSS attack...

CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10144 Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-10145 Hubbub Lite < 1.34.4 - Admin+ Stored XSS

The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...