PT-2025-1847

Name of the Vulnerable Software and Affected Versions Marketplace Items plugin for WordPress versions up to, and including, 1.5.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'envato' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-12288: Cross-Site Request Forgery (CSRF)

The Simple add pages or posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...

CVE-2024-12633: Improper Neutralization of Input During Web Page Generation

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-12256: Improper Neutralization of Input During Web Page Generation

The Simple Video Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'analyticsvideo' parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2024-9354: Improper Neutralization of Input During Web Page Generation

The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12557: Cross-Site Request Forgery (CSRF)

The Transporters.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request grante...

GHSA-M78C-QX99-MVW9 Grav Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

REDAXO CMS Cross-site Scripting vulnerability

A stored cross-site scripting XSS vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter...

Cross-Site Scripting (XSS)

Liferay Portal is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation of user input in the Service Class text field, allowing remote attackers to inject arbitrary web scripts or HTML...

CVE-2024-35498: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-35498

A cross-site scripting XSS vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-35498

The Grav CMS (version 1.7.45) is vulnerable to a cross-site scripting (XSS) flaw caused by the improper handling of user input during web page generation. An attacker can exploit this by providing a crafted payload to execute arbitrary web scripts or HTML. While specific exploit links are not pro...

CVE-2024-35498

A cross-site scripting XSS vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-35498

A cross-site scripting XSS vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-46209

A stored cross-site scripting XSS vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter...

CVE-2024-46209

A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS v5.17.1 within the /media/test.html component. The flaw allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the password parameter. As a temporary workaround, it is recommended to disa...

CVE-2024-12475

CVE-2024-12475 describes a Stored Cross-Site Scripting flaw in the WP Multistore Locator plugin for WordPress, affecting versions up to 2.4.1. The root cause is insufficient input sanitization and output escaping, enabling an authenticated attacker with Contributor+ privileges to inject scripts t...

CVE-2024-11974

The CVE-2024-11974 vulnerability affects the Media Library Assistant WordPress plugin. It enables Reflected Cross-Site Scripting via the smc_settings_tab, unattachfixit-action, and woofixit-action parameters in all versions up to and including 3.23, due to insufficient input sanitization and outp...

CVE-2024-12279: Cross-Site Request Forgery (CSRF)

The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a...

CVE-2024-12100

The Bitcoin Lightning Publisher for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject...