CVE-2024-49646

CVE-2024-49646 affects the WordPress plugin Code Generate (<= 1.0). The vulnerability is a Reflected XSS caused by improper input neutralization during web page generation, enabling an attacker to inject script via unauthenticated input. The CVSSv3.1 base score is 7.1 (HIGH) with NETWORK attac...

CVE-2024-49648

The CVE-2024-49648 entry refers to a reflected XSS in the WordPress SVG Captcha plugin (versions <= 1.0.11) caused by improper neutralization of input during web page generation. Public sources (Patchstack, Red Hat/ENISA entries) confirm the vulnerability and its unauthenticated disclosure, wi...

CVE-2024-49651

CVE-2024-49651 is a reflected Cross‑Site Scripting (XSS) vulnerability in the WordPress plugin WooCommerce Maintenance Mode (Free) affecting versions up to 2.0.1. The issue arises from improper input neutralization during web page generation, enabling Reflected XSS. Public references (NVD, Red Ha...

CVE-2024-49654

CVE-2024-49654: Reflected XSS in WordPress plugin Extra Privacy for Elementor (versions up to 0.1.3) due to improper input neutralization during web page generation. Public details show affected version range but no patch/fix information is provided in the supplied documents.

CVE-2024-49656 WordPress DocumentPress plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fifthsegment DocumentPress documentpress-display-any-document-on-your-site allows Reflected XSS.This issue affects DocumentPress: from n/a through = 2.1...

CVE-2024-49656

CVE-2024-49656 : Reflected XSS in WordPress DocumentPress plugin (

CVE-2024-49662

CVE-2024-49662 is a report of a Reflected XSS in the WordPress plugin Simple Load More (also listed as Webgensis Simple Load More), affecting versions

CVE-2024-49663

CVE-2024-49663 affects the WordPress plugin uCAT – Next Story (versions ≤ 2.0.0). The description documents an improper neutralization of input during web page generation leading to a reflected XSS vulnerability. Exploitation is possible without authentication (per PatchStack entry), via crafting...

CVE-2024-50407

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Namaste! LMS namaste-lms allows Reflected XSS.This issue affects Namaste! LMS: from n/a through = 2.6.2...

CVE-2024-49670

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Sam Glover Client Power Tools Portal allows Reflected XSS.This issue affects Client Power Tools Portal: from n/a through 1.8.6...

CVE-2024-49678

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Jinwen js allows Reflected XSS.This issue affects js paper: from n/a through 2.5.7...

CVE-2024-49678

CVE-2024-49678 is a reflected XSS in WordPress theme/plugin Js Paper (versions

CVE-2024-50407

Namaste! LMS (Namaste! LMS by Kiboko Labs) contains a Reflected XSS in versions up to 2.6.2 caused by improper input neutralization during web page generation. CVE-2024-50407 documents an XSS vulnerability with CVSS v3.1 base score 7.1 (HIGH) [attack vector: network; user interaction: required]. ...

CVE-2024-49642

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.This issue affects Todo Custom Field: from n/a through = 3.0.4...

CVE-2024-49642

CVE-2024-49642 : Reflected XSS in WordPress Todo Custom Field plugin (

PT-2024-33616 · Unknown · Chatplusjp

Name of the Vulnerable Software and Affected Versions: chatplusjp versions n/a through 1.02 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Reflected XSS. This means that an attacker can inject malicious scripts into a website,...

PT-2024-33613 · Leenk.Me · Leenk.Me

Name of the Vulnerable Software and Affected Versions: leenk.Me versions n/a through 2.16.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks. Recommendations: For version...

Booked Scheduler 2.8.5 Cross Site Scripting / Open Redirection

Exploit Title: Open Redirect / Reflected XSS - booked-schedulerv2.8.5 Date: 10/2024 Exploit Author: Andrey Stoykov Version: 2.8.5 Tested on: Ubuntu 22.04 Blog: https://msecureltd.blogspot.com/2024/10/friday-fun-pentest-series-13-reflected.html...

PT-2024-33603 · Woocommerce · Woocommerce Maintenance Mode

Name of the Vulnerable Software and Affected Versions: WooCommerce Maintenance Mode versions prior to 2.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For...

CVE-2024-50438

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in andymoyle Church Admin church-admin allows Reflected XSS.This issue affects Church Admin: from n/a through 5.0.0...