CVE-2024-13389 Cliptakes <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Cliptakes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cliptakesinputemail' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12477

The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2024-13406

The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feedid' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2024-12117

The CVE-2024-12117 entry concerns Stackable – Page Builder Gutenberg Blocks for WordPress. It is a Stored Cross-Site Scripting (XSS) vulnerability in the Button block’s title parameter, affecting all versions up to and including 3.13.11 due to insufficient input sanitization and output escaping. ...

CVE-2024-13590

The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13584 Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperpictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplie...

The vulnerability of the InnoDB component of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions using the MySQL protocol...

CVE-2025-0450

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-0450

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-0450 Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-0371

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-0371

CVE-2025-0371 concerns the WordPress JetElements plugin, with stored cross-site scripting in multiple widgets in all versions up to 2.7.2.1. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, enabling an authenticated attacker (contributor level or ...

PT-2025-4272 · Oracle · Oracle Financial Services Behavior Detection Platform

Name of the Vulnerable Software and Affected Versions: Oracle Financial Services Behavior Detection Platform versions 8.0.8.1, 8.1.2.7, 8.1.2.8 Description: The issue is related to insufficient input validation in the Oracle Financial Services Behavior Detection Platform, allowing an...

PT-2025-4274 · Oracle · Jd Edwards Enterpriseone Orchestrator

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Orchestrator versions prior to 9.2.9.2 Description: The issue is related to insufficient input validation in the E1 IOT Orchestrator Security component. It can be easily exploited by a low-privileged attacker with...

CVE-2024-8722

CVE-2024-8722 affects the WordPress plugin “Import any XML or CSV File to WordPress PRO” up to version 4.9.7. It is a Stored Cross-Site Scripting (XSS) vulnerability via SVG file uploads caused by insufficient input sanitization and output escaping. An authenticated attacker with Administrator-le...

CVE-2024-13392

CVE-2024-13392 affects the Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress. The vulnerability is Stored XSS via the videowhisper_reviews shortcode in versions up to 1.6.3, requiring authenticated access (contributor+). Wordfence and RH Red Hat records confirm the is...

CVE-2025-0369

The CVE-2025-0369 issue concerns the JetEngine WordPress plugin. A Stored Cross-Site Scripting (XSS) flaw exists in the list_tag parameter, affecting all versions up to 3.6.2, due to insufficient input sanitization and output escaping. The vulnerability can be exploited by authenticated users wit...

CVE-2024-13385 JSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JSM Screenshot Machine Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ssm' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13519 MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting

The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.9.80 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13391

CVE-2024-13391 relates to a Stored Cross‑Site Scripting vulnerability in the WordPress plugin MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet . The flaw exists in the shortcode videowhisper_content_upload_guest and arises from insufficient input sanitization and o...