CVE-2024-12288

The CVE-2024-12288 entry concerns the WordPress plugin Simple add pages or posts. Connected Red Hat advisory RH:CVE-2024-12288 confirms a Cross-Site Request Forgery vulnerability in this plugin, arising from missing nonce validation, enabling unauthenticated attackers to update settings and injec...

CVE-2024-11375 WC1C <= 0.23.0 - Reflected Cross-Site Scripting

The WC1C plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 0.23.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-11375

CVE-2024-11375 affects the WC1C WordPress plugin. The vulnerability is a Reflected Cross-Site Scripting (XSS) in which add_query_arg is used without proper escaping, present in all versions up to and including 0.23.0. This allows unauthenticated attackers to craft a link that, if a user is convin...

CVE-2024-11378 Bizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scripting

The Bizapp for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error' parameter in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-12126

CVE-2024-12126 affects the WordPress plugin SEO Keywords. It enables a reflected Cross-Site Scripting (XSS) through the google_error parameter in all versions up to 1.1.3 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts ...

CVE-2024-12126 SEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameter

The SEO Keywords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘googleerror’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-12214 WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter

The WooCommerce HSS Extension for Streaming Video plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘videolink’ parameter in all versions up to, and including, 3.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-11690

CVE-2024-11690 affects the Financial Stocks & Crypto Market Data Plugin (WordPress) up to version 1.10.3. Affected component: the e parameter; vulnerability type: Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. Impact per sources: unauthenticated attacke...

CVE-2024-12214

CVE-2024-12214 affects the WooCommerce HSS Extension for Streaming Video (WordPress). The vulnerability is a reflected Cross-Site Scripting (Reflected XSS) via the videolink parameter in all versions up to and including 3.31, caused by insufficient input sanitization and output escaping. Exploita...

CVE-2024-11434 WP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting

The WP – Bulk SMS – by SMS.to plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-11434 WP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting

The WP – Bulk SMS – by SMS.to plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12049

CVE-2024-12049 refers to a vulnerability in the WordPress plugin Woo Ukrposhta where a Reflected Cross-Site Scripting (XSS) can be triggered via the order , post , and idd parameters. The issue affects all versions up to and including 1.17.11 and arises from insufficient input sanitization and ou...

CVE-2024-12540

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-54288. Reason: This candidate is a reservation duplicate of CVE-2024-54288. Notes: All CVE users should reference CVE-2024-54288 instead of this candidate. All references and descriptions in this candidate have been...

CVE-2024-12419

The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2024-12098

The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utmkeyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12540

CVE-2024-12540 is rejected; this candidate is a reservation duplicate of CVE-2024-54288 and not in use.

CVE-2024-12540

...

CVE-2024-12540

...

CVE-2024-12098 ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting

The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utmkeyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12098 ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting

The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utmkeyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...