CVE-2024-11365 Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...

CVE-2024-11360 Page Parts <= 1.4.3 - Reflected Cross-Site Scripting

The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-11360 Page Parts <= 1.4.3 - Reflected Cross-Site Scripting

The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-11360

CVE-2024-11360 → WordPress Page Parts plugin

CVE-2024-11435

The CVE-2024-11435 entry refers to the salavat counter Plugin for WordPress with a Reflected Cross‑Site Scripting vulnerability via the page parameter in all versions up to and including 0.9.1. The issue allows unauthenticated attackers to inject scripts in pages that users may execute after cert...

CVE-2024-11435 salavat counter Plugin <= 0.9.4 - Reflected Cross-Site Scripting

The salavat counter Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-10726 Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to inject malicious w...

CVE-2024-10726 Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to inject malicious w...

CVE-2024-11370

CVE-2024-11370 concerns the WordPress plugin “Subaccounts for WooCommerce”. The connected sources confirm a reflected Cross-Site Scripting (XSS) weakness caused by improper escaping in URLs using add_query_arg, affecting all versions up to and including 1.6.0. This enables unauthenticated attacke...

CVE-2024-10682 Bulletin Announcements <= 3.11.7 - Reflected Cross-Site Scripting

The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg and removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.11.7. This makes it possible for unauthenticated...

CVE-2024-10682

CVE-2024-10682: WordPress Bulletin Announcements plugin is vulnerable to Reflected XSS via add_query_arg/remove_query_arg without proper escaping in all versions up to 3.11.7. Exploitation requires user interaction (tricking a user into clicking a link) and is possible for unauthenticated attacke...

PT-2024-16750

Name of the Vulnerable Software and Affected Versions Anonymous Restricted Content plugin for WordPress versions up to, and including, 1.6.5 Description The issue allows unauthenticated attackers to extract sensitive data from posts restricted to logged-in users via the WordPress core search...

CVE-2024-10913

The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the 'recursiveunserializedreplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain i...

CVE-2024-10913

CVE-2024-10913 affects the WordPress Clone plugin (versions up to 2.4.6) with an unauthenticated PHP Object Injection via deserialization in recursive_unserialized_replace. Impact ranges from arbitrary file deletion, data exposure, to code execution if a POP chain exists with another plugin/theme...

CVE-2024-9239

The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 7.2.3. This makes it possible for unauthenticated attackers to inject...

CVE-2024-10899 WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting

The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it...

CVE-2024-9239 Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting

The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 7.2.3. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9239

CVE-2024-9239: Booster for WooCommerce (WordPress)

CVE-2024-8726 MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-8726 MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web...