CVE-2025-1286 Download HTML TinyMCE Button <= 1.2 - Reflected XSS

The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-1303 Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS

The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2025-1288 wooexim <= 5.0.0 - CSRF to Reflected XSS

The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack...

CVE-2025-1303

CVE-2025-1303 concerns the Plugin Oficial WordPress plugin (Getnet para WooCommerce) up to version 1.7.3. The issue is a reflected cross-site scripting (XSS) vulnerability caused by a parameter not being sanitised/escaped before being echoed in the page. Exploitation is described against unauthen...

CVE-2025-0688

CVE-2025-0688 affects the WordPress plugin Spiritual Gifts Survey (and S.H.A.P.E. survey) versions ≤ 0.9.10. The vulnerability arises because a parameter is not sanitized/escaped before being echoed in the page, producing a reflected XSS. Exploitation could impact unauthenticated users and is des...

CVE-2024-6667 kbucket < 4.1.5 - Reflected XSS

The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin...

CVE-2024-6667

The CVE-2024-6667 entry concerns the WordPress plugin KBucket: Your Curated Content in WordPress. It states that versions prior to 4.1.5 do not sanitise or escape a parameter before outputting it on the page, leading to a Reflected XSS that could target admins. The CVSS v3.1 base score is 6.1 (Me...

CVE-2024-13865 drm-protected-video-streaming <= 4.2.1 - Reflected XSS

The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13865 drm-protected-video-streaming <= 4.2.1 - Reflected XSS

The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13865

The CVE-2024-13865 entry concerns the WordPress plugin S3Player (drm-protected-video-streaming) up to version 4.2.1. Affected component: the plugin’s output path for a request parameter. Root cause: input is not properly sanitized/escaped before being echoed into the page, resulting in a Reflecte...

CVE-2024-13823 360 Product Rotation <= 1.5.8 - Reflected XSS

The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13727 MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS

The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13727 MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS

The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13828

The Badgearoo WordPress plugin (

CVE-2024-13828 Badgearoo <= 1.0.14 - Reflected XSS

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13727

CVE-2024-13727 concerns the MemberSpace WordPress plugin, affected versions prior to 2.1.14. The issue is a reflected Cross‑Site Scripting (XSS) vulnerability caused by insufficient sanitization/escaping of a parameter before output in the page. The impact, as documented, is a reflected XSS that ...

CVE-2024-13828 Badgearoo <= 1.0.14 - Reflected XSS

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12873 Custom Field Manager <= 1.0 - Reflected XSS Vulnerability

The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...