CVE-2024-12879

The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qcwplatestupdatecheckpro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with...

CVE-2024-12879 WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation

The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qcwplatestupdatecheckpro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with...

CVE-2024-12879 WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation

The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qcwplatestupdatecheckpro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with...

CVE-2024-12879

CVE-2024-12879 concerns WPBot Pro WordPress Chatbot plugin (versions up to and including 13.5.5). The connected sources confirm a missing capability check in the qc_wp_latest_update_check_pro function that permits authenticated users with Subscriber-level access and above to create Simple Text Re...

CVE-2024-13590

The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13590

The CVE-2024-13590 entry concerns the Ketchup Shortcodes WordPress plugin (versions up to 0.1.2) and describes a Stored Cross-Site Scripting vulnerability in the spacer shortcode caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authe...

CVE-2024-13584

CVE-2024-13584 concerns the WordPress plugin “Picture Gallery – Frontend Image Uploads, AJAX Photo List” (versions up to and including 1.5.19). The issue is a Stored Cross-Site Scripting (Stored XSS) flaw caused by insufficient input sanitization and output escaping in the videowhisper_pictures s...

CVE-2024-13584 Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperpictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplie...

CVE-2025-0450

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11226

The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11226 FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11226 FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11226

The CVE-2024-11226 entry concerns FireCask Like & Share Button for WordPress (versions up to 1.2). The vulnerability is a Stored Cross-Site Scripting issue in the width parameter caused by insufficient input sanitization and output escaping. Exploitation requires authentication with Contributor-l...

CVE-2025-0371

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-0369

The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘listtag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-13433

The Utilities for MTG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12696

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisperpictureuploadguest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user...

CVE-2024-13385

The JSM Screenshot Machine Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ssm' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13433 Utilities for MTG <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Utilities for MTG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13433

CVE-2024-13433 affects the Utilities for MTG WordPress plugin. The vulnerability is Stored Cross-Site Scripting via the mtglink shortcode in all versions up to 1.4.1, triggered by authenticated users with contributor-level access and above. The available documents confirm the affected plugin/vers...