CVE-2024-10049

The Edit WooCommerce Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-10014

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-10014

CVE-2024-10014 – Flat UI Button (WordPress) XSS Affected: Flat UI Button plugin for WordPress, version 1.0 and earlier. Root cause: Insufficient input sanitization and output escaping on user-supplied attributes within the flatbtn shortcode. Impact: Stored Cross‑Site Scripting that can execute ar...

CVE-2024-9366 Easy Menu Manager | WPZest <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...

CVE-2024-10014 Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-9366 Easy Menu Manager | WPZest <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...

CVE-2024-10014 Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-9382

CVE-2024-9382 describes a Reflected Cross-Site Scripting (XSS) in the Gantry 4 Framework plugin for WordPress. The vulnerability arises from insufficient input sanitization and output escaping in the override_id parameter, affecting all versions up to and including 4.1.21. It allows unauthenticat...

CVE-2024-9382 Gantry 4 Framework <= 4.1.21 - Reflected Cross-Site Scripting

The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'overrideid' parameter in all versions up to, and including, 4.1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9892

CVE-2024-9892 affects the WordPress plugin Add Widget After Content (versions

CVE-2024-9892 Add Widget After Content <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-9382 Gantry 4 Framework <= 4.1.21 - Reflected Cross-Site Scripting

The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'overrideid' parameter in all versions up to, and including, 4.1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9452

CVE-2024-9452 (Branding plugin for WordPress) is a stored XSS vulnerability that affects all versions up to 1.0, enabling an authenticated attacker with Author-level access or higher to inject script via SVG file uploads. The available connected documents confirm the root cause as insufficient in...

CVE-2024-9452 Branding <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inje...

CVE-2024-9383 Parcel Pro <= 1.8.4 - Reflected Cross-Site Scripting

The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-8740 GetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting

The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-9350 DPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site Scripting

The DPD Baltic Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchvalue' parameter in all versions up to, and including, 1.2.83 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9373

CVE-2024-9373 – Elemenda WordPress plugin is vulnerable to Stored Cross-Site Scripting via SVG file uploads in versions up to 0.0.2 due to insufficient input sanitization and output escaping.Authenticated users with Author-level access and above can inject scripts that execute when the SVG is vie...

CVE-2024-10049 Edit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via page

The Edit WooCommerce Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-10049

CVE-2024-10049 affects the WordPress plugin “Edit WooCommerce Templates” via Reflected Cross-Site Scripting in the page parameter for all versions up to 1.1.2. The vulnerability is exploitable by unauthenticated attackers who can entice a user to perform an action, injecting scripts into pages th...