CVE-2024-11897

CVE-2024-11897 is a stored cross-site scripting vulnerability in the WordPress plugin “MightyForms” (Contact Form, Survey & Form Builder) affecting versions up to and including 1.3.9. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes within the ...

CVE-2024-11093

CVE-2024-11093 concerns the WordPress plugin SG Helper (versions ≤ 1.0). The vulnerability is a Stored Cross‑Site Scripting via SVG file uploads, caused by insufficient input sanitization and output escaping. It requires authenticated access at Administrator level or higher, and can let the attac...

PT-2024-17227 · WordPress · Responsive Video

Name of the Vulnerable Software and Affected Versions: Responsive Videos plugin for WordPress versions up to, and including, 2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'somryv' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-17017 · WordPress · Intro Tour Tutorial Deeppresentation

Name of the Vulnerable Software and Affected Versions: Intro Tour Tutorial DeepPresentation plugin for WordPress versions up to, and including, 6.5.2 Description: The issue is related to Reflected Cross-Site Scripting via the tab parameter due to insufficient input sanitization and output escapin...

WordPress plugin多款产品 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2024-11200

The Goodlayers Core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘font-family’ parameter in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-11200

The Goodlayers Core WordPress plugin has a Reflected Cross-Site Scripting (font-family) in versions up to 2.0.7. It allows unauthenticated attackers to inject scripts in pages executed when a user clicks a crafted link. The vulnerability is marked as patched in the referenced sources; upgrading t...

CVE-2024-11782

The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstsubscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-11782

The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstsubscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-11782

CVE-2024-11782 concerns the WP Mailster WordPress plugin. Public sources confirm a Stored Cross-Site Scripting (XSS) flaw in the plugin’s mst_subscribe shortcode, exploitable by authenticated users with contributor-level access and above. Affected versions: all up to and including 1.8.17.0. The i...

CVE-2024-11325 AWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting

The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-11853

The jAlbum Bridge plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ar’ parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-11461

The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-11805

The Quick License Manager – WooCommerce Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'submitqlmproducts' parameter in all versions up to, and including, 2.4.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11898

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swin-campaign' shortcode in all versions up to, and including, 2.6.9 due to insufficient input...

CVE-2024-11453

The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gspinwidget' shortcode in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping...

CVE-2024-11805 Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting

The Quick License Manager – WooCommerce Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'submitqlmproducts' parameter in all versions up to, and including, 2.4.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11805

CVE-2024-11805 refers to the WordPress plugin “Quick License Manager – WooCommerce Plugin” which is vulnerable to a Reflected Cross‑Site Scripting (XSS) due to insufficient input sanitization and output escaping in the submit_qlm_products parameter. Affected versions: all up to and including 2.4....

CVE-2024-11805 Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting

The Quick License Manager – WooCommerce Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'submitqlmproducts' parameter in all versions up to, and including, 2.4.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11461

The CVE CVE-2024-11461 affects the WordPress Form Data Collector plugin, up to version 2.2.3. It is a Reflected Cross-Site Scripting vulnerability triggered via the page parameter due to insufficient input sanitization and output escaping. Exploitation requires a user to click a crafted link, ena...