CVE-2024-12873 Custom Field Manager <= 1.0 - Reflected XSS Vulnerability

The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12734

The CVE-2024-12734 entry covers the Advance Post Prefix WordPress plugin (versions through 1.1.1). Affected component: the plugin’s parameter output path where unsanitized/unescaped input is echoed back in the page, causing a Reflected Cross-Site Scripting (XSS) vulnerability. Root cause: imprope...

CVE-2024-12733 AffiliateImporterEb <= 1.0.6 - Reflected XSS via Search

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12734 Advance Post Prefix <= 1.1.1 - Reflected XSS

The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12733 AffiliateImporterEb <= 1.0.6 - Reflected XSS via Search

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12725

The CVE-2024-12725 entry concerns Clasify Classified Listing WordPress plugin (

CVE-2024-12726

The CVE-2024-12726 entry affects the ClipArt WordPress plugin, specifically versions 0.2 and earlier, where a parameter is not sanitized/escaped before being echoed back on the page. This causes a Reflected XSS vulnerability that could be exploited against high-privilege users such as admins. Con...

CVE-2024-12732

CVE-2024-12732 concerns the WordPress plugin AffiliateImporterEb up to version 1.0.6. A reflected XSS exists because a parameter is output without proper sanitisation/escaping, enabling script execution in admin/high-privilege users’ browsers when a crafted request is made. The issue is supported...

CVE-2024-12726 ClipArt <= 0.2 - Reflected XSS

The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12726 ClipArt <= 0.2 - Reflected XSS

The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12732 AffiliateImporterEb <= 1.0.6 - Reflected XSS

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12732 AffiliateImporterEb <= 1.0.6 - Reflected XSS

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12724

WP DeskLite WordPress plugin up to version 1.0.0 is affected by a reflected XSS due to unsanitized/unescaped parameters echoed back in pages. This can enable script execution in admin users’ browsers when a crafted request is sent. Affected: WP DeskLite 1.0.0 and earlier. Root cause: parameter ou...

PT-2025-21560 · WordPress · Download Html Tinymce Button

Name of the Vulnerable Software and Affected Versions: Download HTML TinyMCE Button WordPress plugin versions 1.2 and earlier Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because a parameter is not properly sanitized and escaped before being outputted back i...

PT-2025-21432

Name of the Vulnerable Software and Affected Versions: WP DeskLite WordPress plugin versions 1.0.0 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2025-21433 · WordPress · Clasify Classified Listing Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Clasify Classified Listing WordPress plugin versions 1.0.0 through 1.0.7 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted...

PT-2025-21466 · WordPress · The Badgearoo

Name of the Vulnerable Software and Affected Versions: The Badgearoo WordPress plugin versions 1.0.14 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

PT-2025-21436 · WordPress · Affiliateimportereb

Name of the Vulnerable Software and Affected Versions: AffiliateImporterEb WordPress plugin versions 1.0.0 through 1.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back i...

PT-2025-21460

Name of the Vulnerable Software and Affected Versions: LifterLMS WordPress plugin versions prior to 8.0.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Thi...

WordPress plugin AffiliateImporterEb 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...