CVE-2025-1303

The Plugin Oficial – Getnet para WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 1.8.0 (specifically identified in versions through 1.7.3 ). The root cause is the insufficient sanitization and escaping of the 'page' parameter ...

CVE-2025-1303 Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS

The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2025-1288 wooexim <= 5.0.0 - CSRF to Reflected XSS

The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack...

CVE-2025-0688

The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin versions 0.9.10 and earlier is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is a failure to properly sanitize and escape a parameter before it is output back onto the page. This vulnerabilit...

CVE-2024-6667 kbucket < 4.1.5 - Reflected XSS

The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin...

CVE-2024-6667

The KBucket: Your Curated Content WordPress plugin, in versions prior to 4.1.5 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is output back onto the page. This flaw could be exploited to target admin u...

CVE-2024-13865

The S3Player WordPress plugin (versions 4.2.1 and earlier ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before outputting it back to the page. This vulnerability can be exploited by unauthenticated users . As a ...

CVE-2024-13865 drm-protected-video-streaming <= 4.2.1 - Reflected XSS

The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13865 drm-protected-video-streaming <= 4.2.1 - Reflected XSS

The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13828

The Badgearoo WordPress plugin (versions 1.0.14 and earlier ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitize and escape a parameter before outputting it back onto the page. This flaw could be exploited to target high-privi...

CVE-2024-13828 Badgearoo <= 1.0.14 - Reflected XSS

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13727

The MemberSpace WordPress plugin before version 2.1.14 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before outputting it back onto the page. This vulnerability specifically impacts unauthenticated users , who cou...

CVE-2024-13823 360 Product Rotation <= 1.5.8 - Reflected XSS

The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13727 MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS

The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13727 MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS

The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13828 Badgearoo <= 1.0.14 - Reflected XSS

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12873 Custom Field Manager <= 1.0 - Reflected XSS Vulnerability

The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12873 Custom Field Manager <= 1.0 - Reflected XSS Vulnerability

The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...