CVE-2024-6857

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

📄 WordPress Buddypress Humanity 1.2 Cross Site Request Forgery

WordPress Buddypress Humanity plugin versions 1.2 and below suffer from a cross site request forgery vulnerability. ⚠️ CVE-2025-31033 - CSRF in WordPress Buddypress Humanity Plugin...

CVE-2024-6860 WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-6857 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-13898

The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output...

CVE-2024-13898

CVE-2024-13898 concerns the WordPress plugin “Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website.” The connected documents confirm a Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escapi...

CVE-2024-13898 Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output...

CVE-2025-2874 User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-1762

CVE-2025-1762 concerns the WordPress plugin Event Tickets with Ticket Scanner prior to version 2.5.4. The root cause is missing CSRF protection when updating settings, enabling a logged-in attacker to cause settings changes via CSRF. Public sources (NVD, Red Hat, CVE lists) confirm the vulnerabil...

CVE-2024-13580

The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...

CVE-2025-2205

The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-2078

The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissio...

CVE-2025-2205 GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting

The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it...

PT-2025-10993 · WordPress · Blogbuzztime

Name of the Vulnerable Software and Affected Versions: BlogBuzzTime for WP plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

CVE-2024-13580

The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...

CVE-2024-13580

The CVE-2024-13580 vulnerability affects the XV Random Quotes WordPress plugin (

CVE-2024-13826

The CVE-2024-13826 entry affects the Email Keep WordPress plugin up to version 1.1. Root cause: absence of CSRF protection when updating plugin settings. Impact: an attacker could exploit this CSRF vulnerability to cause a logged-in admin to change settings. The description is corroborated by mul...

CVE-2024-13826 Email Keep <= 1.1 - Email Deletion via CSRF

The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9458

The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1672 Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...