CVE-2024-13220

The CVE-2024-13220 entry describes a Reflected Cross-Site Scripting in the WordPress Google Map Professional (Map In Your Language) plugin (versions <= 1.0) where an input parameter is not sanitized/escaped before being echoed on the page. This could allow an attacker to inject script against ...

CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional Map In Your Language WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional Map In Your Language WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13219 Policy Genius <= 2.0.4 - Reflected XSS

The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13218 Fast Tube <= 2.3.1 - Reflected XSS

The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13219

CVE-2024-13219 is a Reflected XSS in the Privacy Policy Genius WordPress plugin up to version 2.0.4, caused by insufficient sanitisation/escaping of a parameter before output. The issue could impact high-privilege users (e.g., admins) when the vulnerable plugin is active. Publicly available detai...

CVE-2024-13218

CVE-2024-13218 - Fast Tube WordPress plugin : The Fast Tube WordPress plugin (versions up to 2.3.1) is vulnerable to a Reflected Cross-Site Scripting (XSS) due to improper sanitization/escaping of a parameter before it is output on the page. This could allow an attacker to target high-privilege u...

CVE-2024-13112 WP MediaTagger <= 4.1.1 - Reflected XSS

The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13112 WP MediaTagger <= 4.1.1 - Reflected XSS

The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13100

The CVE-2024-13100 entry concerns the OPSI Israel Domestic Shipments WordPress plugin (versions &lt;= 2.6.3). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitisation/escaping of a parameter before it is echoed on the page, potentially impacting high-p...

CVE-2024-12275 CanvasFlow <= 1.5.5 - Reflected XSS

The Canvasflow for WordPress plugin through 1.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12275

CVE-2024-12275 affects the CanvasFlow for WordPress plugin (versions up to 1.5.5). The issue is a Reflected XSS caused by not sanitising/escaping a parameter before echoing it in the page, potentially impacting high-privilege users such as admins. The connected documents confirm the vulnerability...

CVE-2025-0470 Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-0470

CVE-2025-0470 concerns the WordPress plugin Forminator Forms – Contact Form, Payment Form & Custom Form Builder. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability in the title parameter, arising from insufficient input sanitization and output escaping. It affects all versions up t...

PT-2025-2074

Name of the Vulnerable Software and Affected Versions The WordPress Google Map Professional Map In Your Language WordPress plugin versions 1.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before...

PT-2025-2078

Name of the Vulnerable Software and Affected Versions SlideDeck 1 Lite Content Slider plugin versions 1.4.8 and earlier Description The issue arises from the plugin not sanitizing and escaping a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting that...

PT-2025-2010

Name of the Vulnerable Software and Affected Versions WP MediaTagger WordPress plugin versions 4.1.1 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This coul...

PT-2025-1799 · WordPress · Canvasflow

Name of the Vulnerable Software and Affected Versions: Canvasflow for WordPress plugin versions 1.5.5 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This...