CVE-2024-13565 Simple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

The Simple Map No Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-13848

The CVE-2024-13848 entry concerns the Reaction Buttons WordPress plugin. It describes a Stored Cross-Site Scripting (XSS) vulnerability exploitable via admin settings, due to insufficient input sanitization and output escaping in versions up to 2.1.6. Exploitation requires administrator-level per...

CVE-2024-13573 Zigaform – Form Builder Lite <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Zigaform – Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfmrfvar' shortcode in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13576

CVE-2024-13576 affects the Gumlet Video WordPress plugin. The vulnerability is Stored XSS via the gumlet shortcode in all versions up to and including 1.0.3, caused by insufficient input sanitization/out escaping on user-supplied attributes. Exploitation requires authenticated access at contribut...

CVE-2024-12525 Easy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-12525 Easy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13588

CVE-2024-13588: The WordPress Simplebooklet PDF Viewer and Embedder plugin (versions up to 1.1.0; patched in ≤1.1.2) is vulnerable to stored XSS via the simplebooklet shortcode due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (Contributor+) to...

CVE-2024-13577

CVE-2024-13577 — CATS Job Listings (WordPress) stored XSS . The WordPress plugin is vulnerable via the catsone shortcode, allowing stored cross-site scripting in all versions up to 2.0.9 due to insufficient input sanitization and output escaping for user-provided attributes. An authenticated atta...

CVE-2024-12813 Open Hours – Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-13577 CATS Job Listings <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13579

CVE-2024-13579, WP-Asambleas (WordPress): The vulnerability is a stored XSS in the polls_popup shortcode present in WP-Asambleas up to version 2.85.0. The issue arises from insufficient input sanitization and output escaping of user-supplied attributes, enabling an authenticated attacker with con...

CVE-2024-13579 WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pollspopup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13501 WP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13595

CVE-2024-13595 affects the WordPress plugin Simple Signup Form (all versions up to and including 1.6.5). The issue is SQL Injection via the id parameter in the ssf shortcode, caused by insufficient escaping and a lack of proper query preparation. The description specifies that authenticated attac...

CVE-2024-13501

CVE-2024-13501 affects the WordPress WP-FormAssembly plugin. It enables Stored Cross-Site Scripting via the plugin’s shortcodes (formassembly) in all versions up to 2.0.11 due to insufficient input sanitization and output escaping on user-supplied attributes. The impact is that authenticated atta...

CVE-2024-13595 Simple Signup Form <= 1.6.5 - Authenticated (Contributor+) SQL Injection

The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including, 1.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2024-13595 Simple Signup Form <= 1.6.5 - Authenticated (Contributor+) SQL Injection

The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including, 1.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2025-0805 Mortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

CVE-2024-13578 WP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-0805

CVE-2025-0805 involves the Mortgage Calculator / Loan Calculator WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in the plugin’s mlcalc shortcode, arising from insufficient input sanitization and output escaping on user-supplied attributes. It affects all versions up to...