CVE-2024-8703 Z-Downloads < 1.11.6 - Unauthenticated Stored XSS

The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs...

CVE-2024-7762

CVE-2024-7762 affects the WordPress plugin Simple Job Board (versions prior to 2.12.6). The vulnerability arises because the plugin does not prevent listing of uploaded files, allowing unauthenticated users to access and download uploaded resumes. Impact is limited to unauthorized disclosure of u...

CVE-2024-6809 Simple Video Directory < 1.4.3 - Unauthenticated SQLi

The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-6809

The CVE-2024-6809 entry maps to the WordPress Simple Video Directory plugin (versions prior to 1.4.3) where a SQL injection is caused by failing to properly sanitize and escape a parameter used in a SQL statement via an unauthenticated AJAX action. Affected component: plugin code handling the AJA...

CVE-2024-6159 Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi

The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-6159 Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi

The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-13865

The CVE-2024-13865 entry concerns the WordPress plugin S3Player (drm-protected-video-streaming) up to version 4.2.1. Affected component: the plugin’s output path for a request parameter. Root cause: input is not properly sanitized/escaped before being echoed into the page, resulting in a Reflecte...

CVE-2024-13865 drm-protected-video-streaming <= 4.2.1 - Reflected XSS

The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13865 drm-protected-video-streaming <= 4.2.1 - Reflected XSS

The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13823

The 360 Product Rotation WordPress plugin (versions ≤ 1.5.8) is affected by a Reflected XSS vulnerability caused by failure to sanitize/escape a parameter before output back to the page. This can be triggered against unauthenticated users. A fix is to upgrade to a version that properly sanitizes/...

CVE-2024-13727 MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS

The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13823 360 Product Rotation <= 1.5.8 - Reflected XSS

The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-13727 MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS

The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-10504 ARForms Builder < 1.7.1 - Unauthenticated Stored XSS

The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks...

CVE-2024-10504

CVE-2024-10504 affects the WordPress plugin Contact Form, Survey, Quiz & Popup Form Builder (ARForms Builder) , specifically versions prior to 1.7.1 . The issue is an improper sanitisation/escaping of certain parameters when they are output on a page, enabling unauthenticated users to perform Cro...

CVE-2024-10075 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution

The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block...

PT-2025-21465 · WordPress · 360 Product Rotation

Name of the Vulnerable Software and Affected Versions: 360 Product Rotation WordPress plugin versions 1.5.8 and earlier Description: The issue is related to a Reflected Cross-Site Scripting error. This occurs because a parameter is not properly sanitized and escaped before being outputted back in...

PT-2025-21531 · WordPress · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Event Calendar WordPress plugin versions 1.0.0 through 1.0.4 Description: The issue concerns a lack of authorization checks on delete actions, allowing unauthenticated users to delete arbitrary calendars. This means that without proper...

PT-2025-21498 · WordPress · Simple Video Directory

Name of the Vulnerable Software and Affected Versions: The Simple Video Directory WordPress plugin versions prior to 1.4.3 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to...

PT-2025-21462 · WordPress · Memberspace

Name of the Vulnerable Software and Affected Versions: MemberSpace WordPress plugin versions prior to 2.1.14 Description: The issue arises from the plugin's failure to sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting issue that...