CVE-2024-9421

CVE-2024-9421 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Login Logout Shortcode. The issue affects versions up to and including 1.1.0 and arises from insufficient input sanitization and output escaping in the plugin’s handling of the class parameter. An at...

CVE-2024-9349

CVE-2024-9349 affects the WordPress plugin “Auto Amazon Links – Amazon Associates Affiliate Plugin” and is a reflected Cross-Site Scripting (XSS) vulnerability in how add_query_arg is used without proper escaping. It impacts all versions up to and including 5.4.2. Exploitation requires user inter...

CVE-2024-9353 Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting

The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-9353 Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting

The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-9345 Product Delivery Date for WooCommerce – Lite <= 2.7.3 - Reflected Cross-Site Scripting

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9345 Product Delivery Date for WooCommerce – Lite <= 2.7.3 - Reflected Cross-Site Scripting

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject...

CVE-2024-8802 Clio Grow <= 1.0.2 - Reflected Cross-Site Scripting

The Clio Grow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-46409

A stored cross-site scripting XSS vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter in the Calendar page...

CVE-2024-9378

The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-9218

The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including,...

CVE-2024-9218

CVE-2024-9218 affects the WordPress plugin Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid. It is a Reflected Cross-Site Scripting vulnerability caused by improper escaping of URLs when using add_query_arg in versions up to and incl...

CVE-2024-9378 YML for Yandex Market <= 4.7.2 - Reflected Cross-Site Scripting

The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-9378

CVE-2024-9378 : YML for Yandex Market plugin for WordPress, versions up to and including 4.7.2, is vulnerable to Reflected XSS via the page parameter due to insufficient input sanitization/escaping. Exploitation requires user interaction (tricking a user into clicking a link). The issue affects t...

CVE-2024-9210

The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2024-9210 MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scripting

The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2024-9222

The CVE refers to the WordPress plugin Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (vendor: Paid Memberships Pro) with CVE-2024-9222. It describes a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient escaping of add_query...

CVE-2024-9209

The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-8799

The Custom Banners plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 3.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVE-2024-8786

The Auto Featured Image from Title plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-8786 Auto Featured Image from Title <= 2.3 - Reflected Cross-Site Scripting

The Auto Featured Image from Title plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to inject arbitrary web...