9968 matches found
CVE-2024-12153
The GDY Modular Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 0.9.92. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2024-11377
The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-11378
The Bizapp for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error' parameter in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2024-11363
The Same but Different – Related Posts by Taxonomy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated...
CVE-2024-11290
The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to...
CVE-2024-11375
The WC1C plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 0.23.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
CVE-2024-12435
CVE-2024-12435 affects the WordPress plugin Compare Products for WooCommerce and is a reflected cross-site scripting (XSS) vulnerability via the s_feature parameter in all versions up to and including 3.2.1. Root cause: insufficient input sanitization and lack of proper output escaping. Impact: u...
CVE-2024-12324
CVE-2024-12324 corresponds to a Reflected Cross-Site Scripting vulnerability in the WordPress plugin “Unilevel MLM Plan.” The flaw is triggered via the page parameter and exists in all versions up to and including 1.1.0, due to insufficient input sanitization and output escaping. The vulnerabilit...
CVE-2024-12324 Unilevel MLM Plan <= 1.1.0 - Reflected Cross-Site Scripting via 'page'
The Unilevel MLM Plan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2024-11810 PayGreen Payment Gateway <= 1.0.26 - Reflected Cross-Site Scripting
The PayGreen Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'messageid' parameter in all versions up to, and including, 1.0.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-11810
CVE-2024-11810 – PayGreen Payment Gateway (WordPress) reflected XSS : The WordPress PayGreen Payment Gateway plugin is vulnerable to Reflected Cross-Site Scripting via the message_id parameter in all versions up to and including 1.0.26 due to insufficient input sanitization and output escaping. T...
CVE-2024-12322
CVE-2024-12322 : The PerfectWedding.nl Widget for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to 2.8 due to missing/incorrect nonce validation on the update_option path. This permits unauthenticated attackers to modify the tpwKey option, enabling stored XSS whe...
CVE-2024-12470 School Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation
The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to the registration function not properly limiting what roles a user can register as. This makes it possible for unauthenticated attackers to...
CVE-2024-9208 Enable Accessibility <= 1.4.1 - Reflected Cross-Site Scripting
The Enable Accessibility plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2024-9208
The CVE-2024-9208 issue affects the WordPress Enable Accessibility plugin (versions up to and including 1.4.1). It describes a Reflected Cross-Site Scripting vulnerability caused by insufficient escaping when using add_query_arg and remove_query_arg in the URL, enabling unauthenticated attackers ...
CVE-2024-12256
The CVE-2024-12256 entry concerns the Simple Video Management System WordPress plugin, vulnerable to Reflected Cross-Site Scripting via the analytics_video parameter in all versions up to 1.0.4. Root cause: insufficient input sanitization and output escaping. Impact: unauthenticated attackers cou...
CVE-2024-12256 Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting
The Simple Video Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'analyticsvideo' parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...
CVE-2024-11377 Automate Hub Free by Sperse.IO <= 1.7.0 - Reflected Cross-Site Scripting
The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...