PT-2025-2118 · WordPress · Transfinanz Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: TransFinanz WordPress plugin version 1.0.0 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...

WordPress plugin Solidres has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-13329: Improper Neutralization of Input During Web Page Generation

The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-2116

Name of the Vulnerable Software and Affected Versions JustRows free WordPress plugin versions 0.2 and earlier Description The issue arises from the plugin not sanitising and escaping a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. This could be used...

CVE-2024-13114: Improper Neutralization of Input During Web Page Generation

The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13332: Improper Neutralization of Input During Web Page Generation

The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-0368: Improper Neutralization of Input During Web Page Generation

The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users...

CVE-2024-13330: Improper Neutralization of Input During Web Page Generation

The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress CM Answers plugin <= 3.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin CM Answers versions = 3.2.4...

WordPress CM Business Directory plugin <= 1.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Business Directory versions = 1.3.9...

WordPress CM Pop-Up Banners for WordPress plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Pop-Up banners versions = 1.7.3...

WordPress CM Product Recommendation Widget plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Product Recommendation Widget versions = 1.1.5...

CVE-2025-24576

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Reflected XSS.This issue affects Landing Page Cat: from n/a through = 1.7.7...

CVE-2025-23593

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kvvaradha EmailPress emailpress allows Reflected XSS.This issue affects EmailPress: from n/a through = 1.0...

CVE-2025-23984

CVE-2025-23984 is a confirmed reflected XSS in the WordPress plugin “Dynamic URL SEO” (versions up to 1.0). The vulnerability arises from improper input neutralization during dynamic page generation, enabling reflected XSS. Affected software is the Dynamic URL SEO plugin

CVE-2025-22682

CVE-2025-22682 concerns the WordPress plugin Hesabfa Accounting (versions

CVE-2025-22679 WordPress Job Board Manager Plugin <= 2.1.61 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Job Board Manager job-board-manager allows Reflected XSS.This issue affects Job Board Manager: from n/a through = 2.1.61...

CVE-2025-22679 WordPress Job Board Manager Plugin <= 2.1.60 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Job Board Manager allows Reflected XSS. This issue affects Job Board Manager: from n/a through 2.1.60...

CVE-2025-22679

CVE-2025-22679 concerns the WordPress Job Board Manager plugin. Affected versions are

CVE-2025-24684 WordPress Media Downloader Plugin <= 0.4.7.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through = 0.4.7.5...