CVE-2024-13533

The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' parameter in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2024-13483

The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 2.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

CVE-2024-13533

CVE-2024-13533 affects the WordPress plugin Small Package Quotes – USPS Edition, Vulnerable via the edit_id parameter. Versions up to and including 1.3.5 suffer SQL Injection due to insufficient escaping and lack of proper preparation in the SQL query, enabling unauthenticated attackers to append...

CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injection

The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-13485

CVE-2024-13485 affects the WordPress plugin “LTL Freight Quotes – ABF Freight Edition” up to version 3.3.7. The vulnerability is an unauthenticated SQL injection via the parameters “edit_id” and “dropship_edit_id” caused by insufficient escaping and unsafe query construction, enabling attackers t...

CVE-2024-13478

The CVE covers the WordPress plugin LTL Freight Quotes – TForce Edition. Affected component: the WordPress plugin (ltl-freight-quotes-ups-edition). Root cause: insufficient escaping on the user-supplied parameters dropship_edit_id and edit_id and inadequate preparation of the underlying SQL query...

CVE-2024-13479

The CVE-2024-13479 entry for LTL Freight Quotes – SEFL Edition (WordPress plugin) is supported by connected data indicating an unauthenticated SQL Injection via dropship_edit_id and edit_id in all versions up to 3.2.4 due to insufficient escaping on the input and inadequate prep in the SQL query....

CVE-2024-13489

The CVE-2024-13489 entry concerns the WordPress plugin LTL Freight Quotes – Old Dominion Edition. Affected: all versions up to 4.2.10. Vulnerability: SQL Injection via parameters edit_id and dropship_edit_id due to insufficient escaping and lack of prepared statements in the existing SQL query. I...

CVE-2024-13336

The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto...

CVE-2024-13363

The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2024-13363 Raptive Ads <= 3.6.3 - Reflected Cross-Site Scripting

The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2024-13363

CVE-2024-13363 affects the Raptive Ads WordPress plugin. Connected sources confirm a Reflected Cross-Site Scripting vulnerability via the poc parameter in all versions up to 3.6.3, exploitable by unauthenticated attackers. The issue is explicitly noted as patched in newer releases; remediation is...

CVE-2024-13363 Raptive Ads <= 3.6.3 - Reflected Cross-Site Scripting

The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2024-13339

CVE-2024-13339 is a CSRF to Stored XSS vulnerability in the DeBounce Email Validator WordPress plugin. Public details show an unauthenticated attacker can forge requests (via the plugin’s settings page) to update settings and inject malicious scripts, affecting WordPress sites using the plugin up...

CVE-2024-13336 Disable Auto Updates <= 1.4 - Cross-Site Request Forgery to Auto-update Disable

The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto...

CVE-2024-13736

The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2025-0865

The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wpmcmhandleactionsettings function. This makes it possible for unauthenticated attackers to alter plugin settings...

CVE-2024-13711

The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-13712

The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-13711

The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...