CVE-2024-13730 Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS

The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13127

CVE-2024-13127 concerns the LearnPress WordPress LMS Plugin prior to 4.2.7.5.1. The vulnerability arises because the plugin does not sanitize and escape certain settings, enablingStored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins) in multisite scenarios even when unfil...

CVE-2024-12770 WP ULike < 4.7.6 - Admin+ Stored XSS

The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12739 Mobile Contact Bar < 3.0.5 - Admin+ Stored XSS

The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11109 WP Google Review Slider < 15.6 - Admin+ Stored XSS

The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11109 WP Google Review Slider < 15.6 - Admin+ Stored XSS

The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10632 Nokaut Offers Box <= 1.4.0 - Admin+ Stored XSS

The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10149 Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets

The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-4552

A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/system/user/1/password. The manipulation leads to unverified password change. The attack can be launched remotely. The exploi...

CVE-2025-28057

owl-admin v3.2.2 to v4.10.2 is vulnerable to SQL Injection in /admin-api/system/adminmenus/saveorder...

CVE-2025-4551

A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

PT-2025-20674 · Unknown · Continew Admin

Name of the Vulnerable Software and Affected Versions: ContiNew Admin versions up to 3.6.0 Description: A vulnerability has been found in ContiNew Admin, allowing for unverified password change. The issue affects an unknown functionality of the file "/dev-api/system/user/1/password". This can be...

SourceCodester Online Student Clearance System 注入漏洞

SourceCodester Online Student Clearance System is a SourceCodester open source online student management system. SourceCodester Online Student Clearance System version 1.0 has an injection vulnerability, the vulnerability stems from the parameter txtfullname/txtemail/cmddesignation operation in t...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the EntriesForm class in the Forms module. An attacker can submit files with malicious filenames and execute arbitrary JavaScript in the browser context of authenticated admins. Note: This is a persistent XS...

CVE-2025-3502 WP Maps < 4.7.2 - Admin+ Stored XSS

The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13874

The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Reservit Hotel 2.1 - Stored Cross-Site Scripting (XSS)

Exploit Title: Reservit Hotel Content 3. Add the following payload to the Button text French field sane save: " style=animation-name:rotation onanimationstart=alert/XSS/// 4. The XSS will trigger upon saving and when any user will access the content dashboard again References:...

WordPress Slider by 10Web plugin < 1.2.62 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Slider by 10Web versions 1.2.62...

WordPress Photo Gallery by 10Web plugin < 1.8.33 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Photo Gallery by 10Web versions 1.8.33...

PHPGurukul Banquet Booking System 注入漏洞

PHPGurukul Banquet Booking System is a banquet booking system from PHPGurukul. An injection vulnerability exists in version 1.2 of the PHPGurukul Banquet Booking System, which stems from improper manipulation of the viewid parameter in the /admin/view-user-queries.php file, which could lead to an...