CVE-2024-9584

The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functions in versions up to, and including, 6.0.20. This makes it possible for authenticated attackers with contributor-level privileges or abov...

CVE-2024-9585

The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saveproject' function with an arbitrary shortcode in versions up to, and including, 6.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-9585

The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saveproject' function with an arbitrary shortcode in versions up to, and including, 6.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-10374

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmemloginout shortcode in all versions up to, and including, 3.4.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-8666

The Shoutcast Icecast HTML5 Radio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'html5radio' shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-8666

The CVE-2024-8666 issue affects the WordPress plugin Shoutcast Icecast HTML5 Radio Player. It is a Stored Cross-Site Scripting (XSS) via the html5radio shortcode in all versions up to and including 2.1.6, caused by insufficient input sanitization and output escaping on user-supplied attributes. E...

CVE-2024-8666 Shoutcast Icecast HTML5 Radio Player <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Shoutcast Icecast HTML5 Radio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'html5radio' shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10016

CVE-2024-10016 affects the File Upload Types by WPForms WordPress plugin. A stored XSS was reported via SVG file uploads in all versions

CVE-2024-10343 Beek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Beek Widget Extention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10343

CVE-2024-10343 affects Beek Widget Extention (WordPress plugin) ≤ 0.9.5 with Stored Cross-Site Scripting via shortcode attributes. Authenticated attackers with contributor+ rights can inject scripts that run on pages when visited. A fix/patch is not publicly documented in the provided connected s...

CVE-2024-9628

CVE-2024-9628 affects the WordPress plugin WPS Telegram Chat . The vulnerability arises from a missing capability check in the function Wps_Telegram_Chat_Admin::checkСonnection , in versions up to and including 4.5.4 . This design flaw enables authenticated attackers with subscriber-level access ...

CVE-2024-10150 Bamazoo – Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode

The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-9235

CVE-2024-9235 relates to Mapster WP Maps (WordPress) plugin, affected versions up to and including 1.5.0. The issue is caused by an insufficient capability check in the mapster_wp_maps_set_option_from_js() function, enabling authenticated attackers with contributor-level access and above to updat...

CVE-2024-10011 BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal

The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended...

CVE-2024-10148

CVE-2024-10148 affects the WordPress plugin “Awesome Buttons” (versions

CVE-2024-9109 UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteoauthdata function in all versions up to, and including, 2.3.12. This makes it possible for authenticated attackers,...

WordPress plugin Image Map Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-10180

The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fieldgroup shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-10180

CVE-2024-10180 — Stored Cross-Site Scripting in Contact Form 7 – Repeatable Fields (WordPress). Affected: all versions up to 2.0.1; root cause: insufficient input sanitization and output escaping on field_group shortcode attributes. Impact: authenticated attackers with contributor-level access ca...

CVE-2024-8959

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...