CVE-2024-12468 WP Datepicker <= 2.1.4 - Reflected Cross-Site Scripting

The WP Datepicker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpdpgetselecteddatepicker' parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2024-12468 WP Datepicker <= 2.1.4 - Reflected Cross-Site Scripting

The WP Datepicker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpdpgetselecteddatepicker' parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2024-12405

The Export Customers Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't' parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-12034

The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP...

CVE-2024-12100

The Bitcoin Lightning Publisher for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12405 Export Customers Data <= 1.2.3 - Reflected Cross-Site Scripting

The Export Customers Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't' parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-12405 Export Customers Data <= 1.2.3 - Reflected Cross-Site Scripting

The Export Customers Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't' parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-12100 Bitcoin Lightning Publisher for WordPress <= 1.4.1 - Reflected Cross-Site Scripting

The Bitcoin Lightning Publisher for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12100

CVE-2024-12100 affects Bitcoin Lightning Publisher for WordPress (WordPress plugin) up to version 1.4.1. The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by using add_query_arg without proper escaping on URLs, enabling unauthenticated attackers to inject and execute scripts in p...

CVE-2024-12710 WP-Appbox <= 4.5.3 - Reflected Cross-Site Scripting

The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2024-12710 WP-Appbox <= 4.5.3 - Reflected Cross-Site Scripting

The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2024-12710

CVE-2024-12710 concerns the WP-Appbox WordPress plugin. A Reflected Cross-Site Scripting vulnerability exists in the page parameter across all versions up to 4.5.3 due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts that execute when us...

CVE-2024-12266 ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elexdpexportrules and elexdpimportrules functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated...

CVE-2024-12408

The WP on AWS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $POST data in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-11688 LaTeX2HTML <= 2.5.5 - Reflected Cross-Site Scripting

The LaTeX2HTML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ver' or 'date' parameter in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-12408

CVE-2024-12408 (WP on AWS) describes a Reflected Cross-Site Scripting vulnerability in the WordPress WP on AWS plugin. All versions up to 5.2.1 are affected due to insufficient input sanitization and output escaping in POST data, enabling unauthenticated attackers to inject script if a user is tr...

CVE-2024-12408 WP on AWS <= 5.2.1 - Reflected Cross-Site Scripting

The WP on AWS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $POST data in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-12262

The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and including, 5.8001 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-12262

The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and including, 5.8001 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-11975

The Reactflow Visitor Recording and Heatmaps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpnonce' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...