CVE-2024-50532 WordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through = 0.1...

CVE-2024-51634 WordPress Webriti Custom Login plugin <= 0.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in a.ankit Webriti Custom Login webriti-custom-login-page allows Reflected XSS.This issue affects Webriti Custom Login: from n/a through = 0.3...

CVE-2024-9777

The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVE-2024-9777 Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter

The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVE-2024-9777 Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter

The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVE-2024-9830 Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter

The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVE-2024-9830 Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter

The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVE-2024-52418

CVE-2024-52418 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress theme/Gameplan by CactusThemes, affecting versions up to 1.5.10. The issue arises from improper neutralization of user input during web page generation, enabling an attacker to cause Reflected XSS in the victi...

CVE-2024-8873 PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting

The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-8873

CVE-2024-8873 : PeproDev WooCommerce Receipt Uploader for WordPress is vulnerable to Reflected Cross-Site Scripting due to improper escaping of URLs when using add_query_arg, affecting all versions up to and including 2.6.9. Exploitation requires user interaction (e.g., tricking a user into click...

CVE-2024-9615

CVE-2024-9615 (BulkPress) affects the WordPress plugin BulkPress up to version 0.3.5. Root cause: use of add_query_arg without proper escaping in URLs, enabling Reflected Cross-Site Scripting. Impact: unauthenticated attackers can inject scripts into pages executed when a user clicks a manipulate...

CVE-2024-9615 BulkPress <= 0.3.5 - Reflected Cross-Site Scripting

The BulkPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 0.3.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-10875 Gallery Manager <= 1.6.58 - Reflected Cross-Site Scripting

The Gallery Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removeQueryArg without appropriate escaping on the URL in all versions up to, and including, 1.6.58. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-10875 Gallery Manager <= 1.6.58 - Reflected Cross-Site Scripting

The Gallery Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removeQueryArg without appropriate escaping on the URL in all versions up to, and including, 1.6.58. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-10884 SimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site Scripting

The SimpleForm Contact Form Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to...

CVE-2024-10883 SimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site Scripting

The SimpleForm – Contact form made simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers t...

CVE-2024-51496 LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting XSS vulnerability in the "metric" parameter of the "/wireless" and "/health" endpoints allows attackers to inject arbitrary JavaScript. This vulnerability results in the execution of...

CVE-2024-10825 Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL

The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-10825

CVE-2024-10825 affects WordPress plugin Hide My WP Ghost – Security & Firewall (WP Ghost). Impact: Reflected Cross-Site Scripting via the URL in all versions up to 5.3.01 due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject arbitrary scripts int...

CVE-2024-10825 Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL

The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...