9612 matches found
CVE-2024-13327
The CVE covers the Musicbox WordPress plugin (versions 2.0.3 and earlier). A Reflected XSS occurs due to lack of sanitization and escaping of a parameter before it’s output on the page, enabling script execution in the context of high-privilege users (e.g., admins). The Nuclei template confirms t...
CVE-2024-13327 Musicbox <= 2.0.3 - Reflected XSS
The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS
The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13326
CVE-2024-13326 affects the iBuildApp WordPress plugin (versions up to 0.2.0). The issue is a reflected cross-site scripting (XSS) caused by insufficient sanitization/escaping of a parameter before echoing it to the page, enabling an attacker to trick high-privilege users (e.g., admins) into execu...
CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS
The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13325 Glossy <= 2.3.5 - Reflected XSS
The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13114 WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PT-2025-2112
Name of the Vulnerable Software and Affected Versions iBuildApp WordPress plugin versions 0.2.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be...
PT-2025-2118 · WordPress · Transfinanz Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: TransFinanz WordPress plugin version 1.0.0 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...
WordPress plugin Solidres 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2025-2116
Name of the Vulnerable Software and Affected Versions JustRows free WordPress plugin versions 0.2 and earlier Description The issue arises from the plugin not sanitising and escaping a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. This could be used...
WordPress CM Answers plugin <= 3.2.4 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin CM Answers versions = 3.2.4...
WordPress CM Business Directory plugin <= 1.3.9 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Business Directory versions = 1.3.9...
WordPress CM Pop-Up Banners for WordPress plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Pop-Up banners versions = 1.7.3...
WordPress CM Product Recommendation Widget plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Product Recommendation Widget versions = 1.1.5...
CVE-2025-24576
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Reflected XSS.This issue affects Landing Page Cat: from n/a through = 1.7.7...
CVE-2025-23593
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kvvaradha EmailPress emailpress allows Reflected XSS.This issue affects EmailPress: from n/a through = 1.0...
CVE-2025-23984
CVE-2025-23984 is a confirmed reflected XSS in the WordPress plugin “Dynamic URL SEO” (versions up to 1.0). The vulnerability arises from improper input neutralization during dynamic page generation, enabling reflected XSS. Affected software is the Dynamic URL SEO plugin