WordPress Custom DataBase Tables Plugin <= 2.1.34 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Custom DataBase Tables versions = 2.1.34...

CVE-2024-49633

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Designinvento DirectoryPress directorypress allows Reflected XSS.This issue affects DirectoryPress: from n/a through = 3.6.19...

CVE-2024-56296 WordPress Mang Board WP plugin <= 1.8.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hometory Mang Board WP allows Reflected XSS.This issue affects Mang Board WP: from n/a through 1.8.4...

CVE-2025-22326

CVE-2025-22326 is a reflected cross-site scripting vulnerability in the 5centsCDN WordPress CDN Plugin. The entry lists affected software as 5centsCDN from n/a through version 24.8.16, with a CVSSv3.1 base score of 7.1 (HIGH) and network/low-attack-vector conditions; user interaction is required....

CVE-2025-22355 WordPress Kikx Simple Post Author Filter plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in asokaaso2 Kikx Simple Post Author Filter sa-post-author-filter allows Reflected XSS.This issue affects Kikx Simple Post Author Filter: from n/a through = 1.0...

CVE-2025-22357

CVE-2025-22357 details (Reflected XSS): Affects Target Notifications (WordPress plugin) with Improper Neutralization of Input During Web Page Generation. Reported as a Reflected XSS vulnerability that can be exploited remotely via network access, requiring user interaction, and with no privileges...

CVE-2025-22359 WordPress SyncFields plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pjfc SyncFields syncfields allows Reflected XSS.This issue affects SyncFields: from n/a through = 2.1...

CVE-2024-12077 Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'

The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendarid’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-12077

CVE-2024-12077 corresponds to a reflected Cross-Site Scripting vulnerability in the Booking Calendar and Booking Calendar Pro WordPress plugins. The issue is triggered via the calendar_id parameter in all versions up to 3.2.19 (Booking Calendar) and 11.2.19 (Booking Calendar Pro), caused by insuf...

CVE-2024-9354

The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9354 Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting

The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9354

The Estatik Mortgage Calculator WordPress plugin (versions up to and including 2.0.11) is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the color parameter. Root cause: insufficient input sanitization and output escaping, enabling an unauthenticated attacker to inject arbitr...

CVE-2024-9354 Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting

The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12633

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-12438

The WooCommerce Digital Content Delivery incl. DRM – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'startdate’ and 'enddate' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-12384

The Binary MLM Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page’ parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2024-11369

The Store credit / Gift cards for woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'coupon', 'startdate', and 'enddate' parameters in all versions up to, and including, 1.0.49.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-12633 JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-12633

The CVE-2024-12633 entry for JoomSport – for Sports: Team & League, WordPress is confirmed by connected documents as a Reflected Cross-Site Scripting vulnerability via the page parameter in versions up to 5.6.17, allowing unauthenticated attackers to inject scripts on pages that a user may load. ...

CVE-2024-12438 WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site Scripting

The WooCommerce Digital Content Delivery incl. DRM – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'startdate’ and 'enddate' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it...