WordPress Offsprout Page Builder plugin 2.2.1-2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function

Authenticated Contributor+ Privilege Escalation via permissioncallback Function vulnerability discovered by kr0d in WordPress Plugin Offsprout Page Builder versions 2.2.1-2.15.2...

WordPress Product Subtitle for WooCommerce plugin <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via htmlTag Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Product Subtitle for WooCommerce versions = 1.3.9...

CVE-2024-30419

Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this...

CVE-2024-23782

Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier versions. If this...

CVE-2022-4480

The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privile...

WordPress Network Posts Extended plugin <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via postheight Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Posts Extended versions = 7.7.1...

WordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Wishlist for WooCommerce versions = 3.2.2...

WordPress If-So Dynamic Content Personalization plugin < 1.8.0.3 - Contributor+ Shortcode Stored XSS vulnerability

Contributor+ Shortcode Stored XSS vulnerability discovered by Felipe Caon in WordPress Plugin If-So Dynamic Content Personalization versions 1.8.0.3...

WordPress JSP Store Locator plugin <= 1.0 - Contributor+ SQL Injection vulnerability

Contributor+ SQL Injection vulnerability discovered by Régis SENET in WordPress Plugin JSP Store Locator versions = 1.0...

WordPress Robo Gallery plugin < 3.2.22 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Robo Gallery versions 3.2.22...

WordPress WP-Members plugin <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpmemusermemberships Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin WP-Members versions = 3.5.2...

WordPress Sticky HTML5 Music Player plugin <= 3.1.6 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Sticky HTML5 Music Player versions = 3.1.6...

CVE-2025-3201 Kali Forms < 2.4.3 - Contributor+ Stored XSS

The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks...

WordPress WordPress Review Plugin plugin <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields vulnerability

Authenticated Contributor+ Local File Inclusion via Post Custom Fields vulnerability discovered by Hiroho Shimada in WordPress Plugin WordPress Review Plugin versions = 5.3.5...

WordPress Contest Gallery plugin <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by stealthcopter in WordPress Plugin Contest Gallery versions = 26.0.6...

WordPress Inline Related Posts plugin <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Inline Related Posts versions = 3.8.0...

WordPress GamiPress plugin <= 7.3.7 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by muhammad yudha in WordPress Plugin GamiPress versions = 7.3.7...

WordPress Contextual Related Posts plugin <= 4.0.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Contextual Related Posts versions = 4.0.2...

WordPress JupiterX Core plugin <= 4.8.11 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Michael in WordPress Plugin JupiterX Core versions = 4.8.11...

WordPress WZ Followed Posts plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin WZ Followed Posts - Display what visitors are reading versions = 3.1.0...