CVE-2024-12218 Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scrip...

PT-2025-1803

Name of the Vulnerable Software and Affected Versions Simple Add Pages or Posts plugin for WordPress versions up to, and including, 2.0.0 Description The issue is due to missing or incorrect nonce validation, allowing unauthenticated attackers to update settings and inject malicious web scripts v...

CVE-2024-12475

The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje...

CVE-2024-12100

CVE-2024-12100 affects Bitcoin Lightning Publisher for WordPress (WordPress plugin) up to version 1.4.1. The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by using add_query_arg without proper escaping on URLs, enabling unauthenticated attackers to inject and execute scripts in p...

CVE-2024-11331

CVE-2024-11331 affects the isee-products-extractor plugin for WordPress (ppy: “استخراج محصولات ووکامرس برای آیسی”). The vulnerability is a Reflected Cross‑Site Scripting in which add_query_arg and remove_query_arg are used without proper escaping, in all versions up to and including 2.1.3. This e...

CVE-2023-37940

Cross-site scripting XSS vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted...

CVE-2023-37940

This CVE refers to a Cross-site Scripting (XSS) vulnerability in the Service Access Policy edit page of Liferay Portal and Liferay DXP. A crafted payload placed in the Service Class field can inject script/HTML, affecting Liferay Portal versions 7.0.0–7.4.3.87 and Liferay DXP 7.4 GA–update 87, an...

CVE-2024-53283

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Router Port Forward functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...

CVE-2024-53281

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Network WOL functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users to read or write specific files containing non-sensitive information and conduct...

CVE-2024-53285

The CVE-2024-53285 flaw affects Synology Router Manager (SRM) versions prior to 1.3.1-9346-10, specifically within the DDNS Record component. The root cause is improper neutralization of input during web page generation, enabling Cross-site Scripting (XSS) by an administrator with full rights. Im...

CVE-2024-53284

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in WiFi Connect Setting functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...

CVE-2024-53281

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Network WOL functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users to read or write specific files containing non-sensitive information and conduct...

CVE-2024-53279

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in file station functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensiti...

CVE-2024-53280

CVE-2024-53280 affects Synology Router Manager (SRM) up to version 1.3.1-9346-10. The vulnerability is an improper input neutralization (XSS) in the Network Center policy route functionality, enabling remote authenticated users with administrator privileges to read or write certain files containi...

CVE-2024-4633

CVE-2024-4633 affects the Slider & Popup Builder by Depicter WordPress plugin. The issue is a Stored Cross-Site Scripting vulnerability via addExtraMimeType in versions up to 3.2.1, exploitable by authenticated users with author-level permissions. The Wordfence entry confirms the vulnerability an...

WordPress plugin Pure CSS Circle Progress bar: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

CVE-2024-11278: Improper Neutralization of Input During Web Page Generation

The GD bbPress Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 4.7.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...

CVE-2024-9830: Improper Neutralization of Input During Web Page Generation

The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

PT-2024-16035

Name of the Vulnerable Software and Affected Versions WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress versions up to, and including, 2.5.7 Description The issue is related to Stored Cross-Site Scripting via the plugin's wpadcenter ad shortcode due to insufficient input sanitization an...

IBM Security ReaQta Cross-Site Scripting Vulnerability

ReaQta is an advanced endpoint security platform from IBM Security that utilizes artificial intelligence and machine learning technologies to identify, manage and automate responses to cybersecurity threats. A cross-site scripting vulnerability exists in Security ReaQta that stems from the...