CVE-2024-10102

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-12464

CVE-2024-12464 (Chatroll Live Chat) is a stored XSS in the Chatroll Live Chat WordPress plugin for versions up to and including 2.5.0, due to insufficient input sanitization and output escaping on shortcode attributes. Exploitation requires authenticated access at contributor level or higher, and...

PT-2025-2907 · Naver · Naver Analytics

Name of the Vulnerable Software and Affected Versions: NAVER Analytics versions 0.9 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting XSS. This means an attacker can inject malicious scripts into...

WordPress Elevio plugin <= 4.4.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Elevio versions = 4.4.1...

PT-2025-3226 · Unknown · Gs Plugins Project Showcase

Name of the Vulnerable Software and Affected Versions: GS Plugins Project Showcase versions 1.1.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, leading to a Stored Cross-Site Scripting XSS vulnerability. This allows for Stored XSS...

CVE-2024-11645

The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11230

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-17716 · WordPress · Real.Kit Plugin

Name of the Vulnerable Software and Affected Versions: real.Kit plugin for WordPress versions up to and including 5.1.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2024-16813 · WordPress · Multi-Column Tag Map

Name of the Vulnerable Software and Affected Versions: Multi-column Tag Map plugin for WordPress versions up to, and including, 17.0.33 Description: The issue is related to Stored Cross-Site Scripting via the plugin's mctagmap shortcode due to insufficient input sanitization and output escaping o...

PT-2024-39722 · WordPress · Wp Shapes

Name of the Vulnerable Software and Affected Versions: WP SHAPES plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to stored Cross-Site Scripting via SVG file uploads due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2024-36285 · Unknown · Flaming Forms

Name of the Vulnerable Software and Affected Versions: Flaming Forms versions 1.0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and al...

PT-2024-36279 · WordPress · Midoks Wp微信机器人

Name of the Vulnerable Software and Affected Versions: Midoks WP微信机器人 versions through 5.3.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also...

PT-2024-36328 · Unknown · Gaxx Keywords

Name of the Vulnerable Software and Affected Versions: Gaxx Keywords versions n/a through 0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2024-36329 · Unknown · Amazon Product Price

Name of the Vulnerable Software and Affected Versions: Alok Tiwari Amazon Product Price versions n/a through 1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions ...

PT-2024-36317 · Unknown · Onigetoc Add Image To Post

Name of the Vulnerable Software and Affected Versions: onigetoc Add image to Post versions n/a through 0.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can perform actions on behalf of a user without their...

PT-2024-17232 · WordPress · Eveeno

Name of the Vulnerable Software and Affected Versions: Eveeno plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode due to insufficient input sanitization and output escaping on user-supplied...

WordPress SIP Calculator plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin SIP Calculator versions = 1.0...

WordPress Cricket Live Score plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin Cricket Live Score versions = 2.0.2...

PT-2024-36168 · WordPress · Best Wp Developer Advanced Blog Post Block

Name of the Vulnerable Software and Affected Versions: Best Wp Developer Advanced Blog Post Block versions 1.0.0 through 1.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

WordPress Floating Video Player plugin <= 1.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Floating Video Player versions = 1.0...