CVE-2024-6544

The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full path...

CVE-2024-8730

CVE-2024-8730 concerns the Exit Notifier plugin for WordPress. A Reflected Cross-Site Scripting vulnerability exists in all versions up to and including 1.9.1 due to improper escaping of URLs when using add_query_arg, enabling unauthenticated attackers to inject script into pages that run when a ...

CVE-2024-8734 Lucas String Replace <= 2.0.5 - Reflected Cross-Site Scripting

The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-8737 PDF Thumbnail Generator <= 1.3 - Reflected Cross-Site Scripting

The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-6544

CVE-2024-6544 affects the WordPress plugin Custom Post Limits (

CVE-2024-8731

CVE-2024-8731 concerns the Cron Jobs plugin for WordPress (versions up to and including 1.2.9). The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by using add_query_arg without proper escaping on the URL, enabling unauthenticated attackers to inject scripts in pages executed afte...

CVE-2024-8731 Cron Jobs <= 1.2.9 - Reflected Cross-Site Scripting

The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-8731 Cron Jobs <= 1.2.9 - Reflected Cross-Site Scripting

The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-8714 WordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site Scripting

The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.20. This makes it possible for unauthenticated attackers to...

CVE-2024-8714

CVE-2024-8714 (SliceWP Affiliates, WordPress) is a Reflected Cross-Site Scripting vulnerability in the SliceWP Affiliates plugin for WordPress, caused by improper escaping of URLs via remove_query_arg. Affected versions are

CVE-2024-8664

The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-8663 WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scripting

The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.10. This makes it possible for unauthenticated attackers to inject...

CVE-2024-8663 WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scripting

The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.10. This makes it possible for unauthenticated attackers to inject...

CVE-2024-8663

CVE-2024-8663: WP Simple Booking Calendar (WordPress)

CVE-2024-8664

CVE-2024-8664 : The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping when using add_query_arg in the URL for all versions up to and including 1.1.7. This allows unauthenticated attackers to trigger/script injection on pages that a use...

CVE-2024-8665 YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting

The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2024-8665

CVE-2024-8665 affects the WordPress plugin YITH Custom Login and its vulnerability is a reflected Cross-Site Scripting (XSS) caused by using add_query_arg without proper escaping in the URL. The issue affects all versions up to and including 1.7.3. The vulnerability can allow unauthenticated atta...

CVE-2024-8665 YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting

The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2024-8656

The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

CVE-2024-8656 WPFactory Helper <= 1.7.0 - Reflected Cross-Site Scripting

The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...