CVE-2024-11465 Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection

The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikeswooproductstabs' post meta parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2024-10527 Spacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure

The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motechspacercallback function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view...

CVE-2024-11383 CC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The CC Canadian Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cc-mortgage-canada' shortcode in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-11383

CVE-2024-11383 – Stored XSS in CC Canadian Mortgage Calculator WordPress plugin : Affected is the CC Canadian Mortgage Calculator plugin for WordPress (versions up to 2.1.0). The issue arises from insufficient input sanitization and output escaping on user-supplied attributes within the shortcode...

CVE-2024-12538 Duplicate Post, Page and Any Custom Post <= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication

The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.5 via the 'dppduplicateasdraft' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-12538

CVE-2024-12538 (WordPress) affects the Duplicate Post, Page and Any Custom Post plugin. According to the provided sources, it exposes sensitive information from draft, scheduled (future), private, and password-protected posts via the dpp_duplicate_as_draft function. The issue requires authenticat...

CVE-2024-12592

CVE-2024-12592 affects the Sellsy WordPress plugin. The issue is a Stored Cross-Site Scripting vulnerability in the plugin’s testSellsy shortcode, exploitable in all versions up to 2.3.3 due to insufficient input sanitization and output escaping of user-supplied attributes. Authenticated attacker...

CVE-2024-11934 Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via address Parameter

The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘address’ parameter in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2024-11934

CVE-2024-11934 affects Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce (WordPress plugin). Root cause: insufficient input sanitization and output escaping allowing Stored Cross-Site Scripting via the address parameter/shortcode. Impact: authenticated attackers with Contributo...

CVE-2024-12590 WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

PT-2025-1919 · WordPress · Sina Extension For Elementor

Name of the Vulnerable Software and Affected Versions: Sina Extension for Elementor plugin for WordPress versions up to, and including, 3.5.91 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget due to insufficient input sanitization and outp...

PT-2025-1708 · WordPress · Geo Content

Name of the Vulnerable Software and Affected Versions: Geo Content plugin for WordPress versions up to and including 6.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the geotargetlygeocontent shortcode. This allows...

CVE-2024-51741

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2...

WordPress Geo Content plugin <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Geo Content versions = 6.0...

WordPress WP Youtube Gallery plugin <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by SOPROBRO in WordPress Plugin WP Youtube Gallery versions = 1.9...

WordPress Duplicate Post, Page and Any Custom Post plugin <= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication vulnerability

Authenticated Contributor+ Post Disclosure via Post Duplication vulnerability discovered by Webbernaut in WordPress Plugin Duplicate Post, Page and Any Custom Post versions = 3.5.5...

CVE-2024-12195

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'projectid' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 d...

CVE-2024-12475

CVE-2024-12475 describes a Stored Cross-Site Scripting flaw in the WP Multistore Locator plugin for WordPress, affecting versions up to 2.4.1. The root cause is insufficient input sanitization and output escaping, enabling an authenticated attacker with Contributor+ privileges to inject scripts t...

CVE-2024-11930 Taskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode

The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppmtasks shortcode in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes...

WordPress WP Project Manager plugin <= 2.6.16 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Project Manager versions = 2.6.16...