CVE-2025-0864

CVE-2025-0864 affects the WordPress plugin Active Products Tables for WooCommerce. Use constructor to create tables. It is vulnerable to Reflected Cross-Site Scripting via the shortcodes_set parameter in all versions up to and including 1.0.6.6, allowing unauthenticated attackers to inject web sc...

CVE-2024-11376 s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 241114...

CVE-2024-11376

CVE-2024-11376 : Affected software is the WordPress plugin “s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions”. The vulnerability is a Reflected Cross-Site Scripting (XSS) due to the use of add_query_arg without proper escaping, reported...

WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin Active Products Tables for WooCommerce versions = 1.0.6.6...

CVE-2024-13627

The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13625

The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13626

The VR-Frases collect & share quotes WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13627

The CVE-2024-13627 entry concerns the OWL Carousel Slider WordPress plugin (versions up to 2.2). The connected docs confirm a vulnerability due to insufficient sanitisation/escaping of a parameter, resulting in a Reflected XSS. Impact is described as potentially affecting high-privilege users (e....

CVE-2024-13627 WP Touch Slider <= 2.2 - Reflected XSS

The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13626

CVE-2024-13626 – VR-Frases WordPress plugin Description from multiple sources: The VR-Frases (collect & share quotes) plugin for WordPress, up to version 3.0.1, does not sanitize/escape a parameter before echoing it on the page, resulting in a Reflected Cross-Site Scripting (XSS). This vulnerabil...

CVE-2024-13626 VR Frases <= 3.0.1 - Reflected XSS

The VR-Frases collect & share quotes WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13626 VR Frases <= 3.0.1 - Reflected XSS

The VR-Frases collect & share quotes WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13625 Tube Video Ads Lite <= 1.5.7 - Reflected XSS

The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13625

The CVE-2024-13625 entry affects the Tube Video Ads Lite WordPress plugin (versions up to 1.5.7). The vulnerability is a Reflected Cross-Site Scripting caused by insufficient sanitization/escaping of an input parameter, which can be triggered in the page output and could impact high-privilege use...

CVE-2024-13625 Tube Video Ads Lite <= 1.5.7 - Reflected XSS

The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-6585

Name of the Vulnerable Software and Affected Versions Tube Video Ads Lite WordPress plugin versions 1.5.7 and earlier Description The issue arises from the plugin's failure to sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting tha...

CVE-2025-22680 WordPress Ad Inserter Pro plugin <= 2.7.39 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue affects Ad Inserter Pro: from n/a through 2.7.39...

CVE-2025-22286 WordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.0.21 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Worldwide Express Edition:...

CVE-2025-23742

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Podamibe Nepal Podamibe Twilio Private Call podamibe-twilio-private-call allows Reflected XSS.This issue affects Podamibe Twilio Private Call: from n/a through = 1.0.1...

CVE-2025-24688

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through = 1.8.20.0...