1514 matches found
CVE-2024-53711
Cross-Site Request Forgery CSRF vulnerability in tranchesdunet Hotlink2Watermark hotlink2watermark allows Stored XSS.This issue affects Hotlink2Watermark: from n/a through = 0.3.2...
WordPress Quote Comments plugin <= 3.0.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Quote Comments versions = 3.0.0...
WordPress Simple Auto Tag plugin <= 1.1 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Simple Auto Tag versions = 1.1...
PT-2025-2000 · WordPress · Wp Mediatagger
Name of the Vulnerable Software and Affected Versions: WP MediaTagger WordPress plugin versions 4.1.1 and earlier Description: The issue concerns the WP MediaTagger WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page or post...
CVE-2025-23057
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...
CVE-2024-13527
The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...
WordPress Target Video Easy Publish plugin <= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Target Video Easy Publish versions = 3.8.3...
PT-2025-2173 · WordPress · Bilingual Linker
Name of the Vulnerable Software and Affected Versions: Bilingual Linker plugin for WordPress versions up to, and including, 2.4 Description: The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allows authenticated...
PT-2025-5406 · Unknown · Reviewstap
Name of the Vulnerable Software and Affected Versions: ReviewsTap versions 1.1.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability and Stored XSS in ReviewsTap. This allows for malicious actions to be performed on behalf of a user without their...
PT-2025-2211 · WordPress · Wp Google Street View
Name of the Vulnerable Software and Affected Versions: WP Google Street View with 360° virtual tour & Google maps + Local SEO plugin for WordPress version 1.1.3 and all versions prior to this. Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode due ...
PT-2025-5493 · Unknown · Ketchup Shortcodes
Name of the Vulnerable Software and Affected Versions: Ketchup Shortcodes versions 0.1.2 and earlier Description: The issue is related to improper neutralization of script-related HTML tags in a web page, which allows for Stored XSS attacks. This means an attacker can inject malicious scripts int...
PT-2025-4687 · Unknown · Qwerty23 Rocket Media Library Mime Type
Name of the Vulnerable Software and Affected Versions: Qwerty23 Rocket Media Library Mime Type versions prior to 2.1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended...
CVE-2025-0450
The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-13444 wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via...
CVE-2024-52888 - Mobile Access File Share applications are vulnerable to stored XSS attacks
Symptoms - When an authenticated Mobile Access portal end-user browses to a File Share application, the portal may run a script while attempting to display a directory or some file's properties. Additionally, an authenticated attacker may store specially crafted file/dir names for other...
PT-2025-4733 · WordPress · Wp Desk Flexible Pdf Coupons
Name of the Vulnerable Software and Affected Versions: WP Desk Flexible PDF Coupons affected versions not specified Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means an attacker can inject...
CVE-2024-13517
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress MarketKing plugin <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting vulnerability
Authenticated Shop Manager+ Stored Cross-Site Scripting vulnerability discovered by Karolina Jankowska in WordPress Plugin MarketKing versions = 1.9.80...
