CVE-2024-12445 RightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The RightMessage WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rmarea' shortcode in all versions up to, and including, 0.9.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12445

CVE-2024-12445 affects the RightMessage WP WordPress plugin. The vulnerability is Stored Cross-Site Scripting in the plugin’s rm_area shortcode, due to insufficient input sanitization and output escaping on user-supplied attributes. It affects all versions up to and including 0.9.7. Successful ex...

CVE-2024-12453 Uptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Uptodown APK Download Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'utd-widget' shortcode in all versions up to, and including, 0.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-11337 Horoscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Horoscope And Tarot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'divinehoroscope' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11383 CC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The CC Canadian Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cc-mortgage-canada' shortcode in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-12592

The Sellsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testSellsy' shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12538

CVE-2024-12538 (WordPress) affects the Duplicate Post, Page and Any Custom Post plugin. According to the provided sources, it exposes sensitive information from draft, scheduled (future), private, and password-protected posts via the dpp_duplicate_as_draft function. The issue requires authenticat...

CVE-2024-11934 Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-12453: Improper Neutralization of Input During Web Page Generation

The Uptodown APK Download Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'utd-widget' shortcode in all versions up to, and including, 0.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-12499: Improper Neutralization of Input During Web Page Generation

The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpjdt' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12439: Improper Neutralization of Input During Web Page Generation

The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-1850

Name of the Vulnerable Software and Affected Versions Candifly plugin for WordPress versions 1.0.6 and earlier Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the candifly shortcode. This allows authenticated attackers with...

PT-2025-1854

Name of the Vulnerable Software and Affected Versions Uptodown APK Download Widget plugin for WordPress versions up to, and including, 0.1.2 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'utd-widget' shortcode due to insufficient input sanitization and output...

PT-2025-1868

Name of the Vulnerable Software and Affected Versions Bootstrap Blocks for WP Editor v2 plugin for WordPress versions up to, and including, 2.5.0 Description The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping in the 'gtb-bootstrap/column...

PT-2025-1889

Name of the Vulnerable Software and Affected Versions Duplicate Post, Page and Any Custom Post plugin for WordPress versions up to and including 3.5.3 Description The issue allows authenticated attackers with Contributor-level access and above to extract potentially sensitive data from draft,...

CVE-2024-11445: Improper Neutralization of Input During Web Page Generation

The Image Magnify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'imagemagnify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11749: Improper Neutralization of Input During Web Page Generation

The App Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appizy' shortcode in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-11382: Improper Neutralization of Input During Web Page Generation

The Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'commonninja' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output...

CVE-2024-11887: Improper Neutralization of Input During Web Page Generation

The Geo Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'geotargetlygeocontent' shortcode in all versions up to, and including, 6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12440: Improper Neutralization of Input During Web Page Generation

The Candifly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'candifly' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...