CVE-2024-13347 Essential WP Real Estate <= 1.1.3 - Reflected XSS

The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

PT-2025-4620 · Unknown · Hesabfa Accounting

Name of the Vulnerable Software and Affected Versions: Hesabfa Accounting versions prior to 2.1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject malicious scripts...

PT-2025-5415 · Peprodev · Peprodev Woocommerce Receipt Uploader

Name of the Vulnerable Software and Affected Versions: PeproDev WooCommerce Receipt Uploader versions prior to 2.6.9 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject...

WordPress Yahoo BOSS Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Yahoo BOSS versions = 0.7...

CVE-2024-13099

The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13097

The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13098

CVE-2024-13098 is a WordPress Email Newsletter plugin (

CVE-2024-13099 Widget4call <= 1.0.7 - Reflected XSS

The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13097 WP Finance <= 1.3.6 - Reflected XSS

The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13099 Widget4call <= 1.0.7 - Reflected XSS

The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13098 WP Email Newsletter <= 1.1 - Reflected XSS

The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13099

CVE-2024-13099 refers to the WordPress Widget4Call plugin (versions up to 1.0.7) and describes a Reflected XSS caused by insufficient sanitisation/escaping of an input parameter when echoed in the page. The vulnerability can be leveraged against high-privilege users (e.g., admins). Public connect...

CVE-2024-13097

CVE-2024-13097 pertains to the WP Finance WordPress plugin (

PT-2025-1996

Name of the Vulnerable Software and Affected Versions WP Finance WordPress plugin versions 1.3.6 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

CVE-2025-0930

Reflected Cross-Site Scripting XSS in TeamCal Neo, version 3.8.2. This allows an attacker to execute malicious JavaScript code, after injecting code via the ‘abs’ parameter in ‘/teamcal/src/index.php’...

CVE-2025-0930 Reflected Cross-Site Scripting (XSS) vulnerability in TeamCal Neo

Reflected Cross-Site Scripting XSS in TeamCal Neo, version 3.8.2. This allows an attacker to execute malicious JavaScript code, after injecting code via the ‘abs’ parameter in ‘/teamcal/src/index.php’...

CVE-2025-0930

CVE-2025-0930: Reflected XSS in TeamCal Neo 3.8.2 via the abs parameter in /teamcal/src/index.php. An attacker can inject JavaScript code through this parameter. No exploit details are provided, and public patches are not confirmed in the supplied sources. PT Security notes that for TeamCal Neo 3...

CVE-2024-13472

The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.9.4. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it...

CVE-2024-13472

CVE-2024-13472 affects the WordPress plugin “WooCommerce Product Table Lite” (versions up to and including 3.9.4). The issue allows unauthenticated attackers to achieve arbitrary shortcode execution due to improper validation before running do_shortcode, and the same sc_attrs parameter is vulnera...

CVE-2025-24710

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Gwolle Guestbook gwolle-gb allows Reflected XSS.This issue affects Gwolle Guestbook: from n/a through = 4.7.1...