16790 matches found
WordPress Dominion plugin <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Dominion versions = 2.3.0...
WordPress GatorMail SmartForms plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin GatorMail SmartForms versions = 1.1.0...
WordPress Accordion Slider Lite plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin Accordion Slider Lite versions = 1.5.1...
CVE-2024-13183 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titletag’ parameter in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-13183 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titletag’ parameter in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-0311 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-12473 AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injection
The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT GPT-4o 128K plugin for WordPress is vulnerable to SQL Injection via the 'templateid' parameter of the 'articlebuildergeneratedata' shortcode in all versions up to, and...
CVE-2024-12473 AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injection
The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT GPT-4o 128K plugin for WordPress is vulnerable to SQL Injection via the 'templateid' parameter of the 'articlebuildergeneratedata' shortcode in all versions up to, and...
CVE-2024-12473
CVE-2024-12473 affects the AI Scribe WordPress plugin (Authenticated: Contributor+). Wordfence and RH Red Hat entries confirm an SQL Injection via template_id in article_builder_generate_data shortcode, exploitable on all versions through 2.3 due to insufficient escaping and query preparation. Im...
PT-2025-1862 · WordPress · Ai Scribe
Name of the Vulnerable Software and Affected Versions: AI Scribe plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to SQL Injection via the template id parameter of the article builder generate data shortcode. This is due to insufficient escaping on the...
PT-2025-2041 · Themeisle · Orbit Fox
Name of the Vulnerable Software and Affected Versions: Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.43 Description: The issue is related to Stored Cross-Site Scripting via the title tag parameter due to insufficient input sanitization and output escaping. This...
CVE-2024-12491
The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'srsearchform' shortcode in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...
CVE-2024-12496
The Linear plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linearblockbuycommissions' shortcode in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-12514
CVE-2024-12514 refers to the WordPress plugin 3D Viewer Online : a stored cross-site scripting flaw in the plugin’s '3Dvo-model' shortcode affecting all versions up to and including 2.2.2 . The vulnerability enables authenticated attackers with contributor-level access or higher to inject scripts...
CVE-2024-12491 SimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'srsearchform' shortcode in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...
CVE-2024-12515
The CVE CVE-2024-12515 affects the WordPress plugin Muslim Prayer Time-Salah/Iqamah (masjidal) up to version 1.8.8. It is a Stored Cross-Site Scripting flaw exploitable by authenticated attackers with Contributor-level access or higher via the Masjid ID parameter, due to insufficient input saniti...
CVE-2024-12491 SimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'srsearchform' shortcode in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...
CVE-2024-12819
CVE-2024-12819 affects the WordPress Searchie plugin up to version 1.17.0. The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin shortcode sio_embed_media, caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers ...
CVE-2024-12621
CVE-2024-12621 – Yumpu E-Paper publishing (WordPress) is a Stored XSS vulnerability in the Yumpu shortcode that affects all versions up to and including 3.0.8. Exploitation requires authenticated access at contributor level or higher, allowing injection of scripts that run when users view the pag...