CVE-2024-13517

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13433

CVE-2024-13433 affects the Utilities for MTG WordPress plugin. The vulnerability is Stored Cross-Site Scripting via the mtglink shortcode in all versions up to 1.4.1, triggered by authenticated users with contributor-level access and above. The available documents confirm the affected plugin/vers...

CVE-2024-13385 JSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JSM Screenshot Machine Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ssm' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13385

CVE-2024-13385 – JSM Screenshot Machine Shortcode (WordPress) is a Stored Cross-Site Scripting vulnerability in the JSM Screenshot Machine Shortcode plugin for WordPress, affecting all versions up to 2.3.0. The issue arises from insufficient input sanitization and lack of proper output escaping o...

CVE-2024-13517

CVE-2024-13517 affects the WordPress extension “Easy Digital Downloads – eCommerce Payments and Subscriptions made easy” (all versions up to 3.3.2). The issue is a Stored Cross-Site Scripting vulnerability in the Title value caused by insufficient input sanitization and output escaping. Exploitat...

CVE-2024-13519 MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting

The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.9.80 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13519

CVE-2024-13519 (MarketKing – Ultimate WooCommerce Multivendor Marketplace Solution) has concrete details in connected records. The vulnerability affects the MarketKing WordPress plugin (MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution) and is a Stored Cross-Site Scripting flaw e...

CVE-2024-13515

The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter in all versions up to, and including, 2.28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13516 Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting

The Kubio AI Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2024-13515

The CVE-2024-13515 entry concerns the WordPress plugin Image Source Control Lite – Show Image Credits and Captions, with a Reflected Cross-Site Scripting vulnerability via the path parameter in all versions up to 2.28.0. The root cause is insufficient input sanitization and output escaping, enabl...

CVE-2024-13515 Image Source Control Lite – Show Image Credits and Captions <= 2.28.0 - Reflected Cross-Site Scripting

The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter in all versions up to, and including, 2.28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13515 Image Source Control Lite – Show Image Credits and Captions <= 2.28.0 - Reflected Cross-Site Scripting

The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter in all versions up to, and including, 2.28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

SUSE CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the...

CVE-2025-23207

A flaw was found in the KaTeX library. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript or generate invalid HTML. Mitigation Users unable to upgrade should turn off the trust option or set ...

PT-2025-1927 · WordPress · The Picture Gallery – Frontend Image Uploads

Name of the Vulnerable Software and Affected Versions: The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress versions up to, and including, 1.5.22 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escapi...

WordPress plugin Podlove Podcast Publisher 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

WordPress plugin Utilities for MTG 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

PT-2025-3856 · WordPress · Jetengine

Name of the Vulnerable Software and Affected Versions: JetEngine plugin for WordPress versions up to, and including, 3.6.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

WordPress plugin MicroPayments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

DEBIAN-CVE-2025-23207

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade t...