CVE-2024-13218 Fast Tube <= 2.3.1 - Reflected XSS

The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13220

The WordPress Google Map Professional (Map In Your Language) plugin versions 1.0 and earlier is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape a parameter before outputting it back to the page. An attacker could exploit this by tricking a...

CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional Map In Your Language WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13218

The Fast Tube WordPress plugin, affecting versions 2.3.1 and earlier , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape a parameter before it is output back onto the page. This vulnerability could be exploited to target hi...

CVE-2024-13222 User Messages <= 1.2.4 - Reflected XSS

The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13219 Policy Genius <= 2.0.4 - Reflected XSS

The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional Map In Your Language WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13219

The Privacy Policy Genius WordPress plugin (versions through 2.0.4 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back to the page. An attacker can exploit this by crafting a malicious URL ...

CVE-2024-13219 Policy Genius <= 2.0.4 - Reflected XSS

The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13100

The OPSI Israel Domestic Shipments WordPress plugin (versions 2.6.3 and earlier ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is a failure to properly sanitise and escape a parameter before it is outputted back to the page. This vulnerability could be used to targ...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13112 WP MediaTagger <= 4.1.1 - Reflected XSS

The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13112 WP MediaTagger <= 4.1.1 - Reflected XSS

The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12275 CanvasFlow <= 1.5.5 - Reflected XSS

The Canvasflow for WordPress plugin through 1.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12275

The Canvasflow for WordPress plugin (versions 1.5.5 and earlier ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape a parameter before it is outputted back to the page. This flaw could be exploited to target high-p...

CVE-2025-0470

CVE-2025-0470 concerns the WordPress plugin Forminator Forms – Contact Form, Payment Form & Custom Form Builder. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability in the title parameter, arising from insufficient input sanitization and output escaping. It affects all versions up t...

CVE-2025-0470 Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2025-2080

Name of the Vulnerable Software and Affected Versions A5 Custom Login Page WordPress plugin versions 2.8.1 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in t...

PT-2025-2078

Name of the Vulnerable Software and Affected Versions SlideDeck 1 Lite Content Slider plugin versions 1.4.8 and earlier Description The issue arises from the plugin not sanitizing and escaping a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting that...