CVE-2024-12457 Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vchat' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escapi...

CVE-2024-12290

CVE-2024-12290: Infility Global WordPress plugin allows unauthenticated Reflected XSS via the set_type parameter in all versions up to 2.9.8; exploit injects script into pages executed when a user clicks a link. Patch status in connected docs indicates a fix has been applied.

CVE-2024-12290 Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter

The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘settype’ parameter in all versions up to, and including, 2.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-12126

CVE-2024-12126 affects the WordPress plugin SEO Keywords. It enables a reflected Cross-Site Scripting (XSS) through the google_error parameter in all versions up to 1.1.3 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts ...

CVE-2024-12214 WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter

The WooCommerce HSS Extension for Streaming Video plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘videolink’ parameter in all versions up to, and including, 3.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-12126 SEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameter

The SEO Keywords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘googleerror’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-11690 Financial Stocks & Crypto Market Data Plugin <= 1.10.3 - Reflected Cross-Site Scripting

The Financial Stocks & Crypto Market Data Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'e' parameter in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2024-12214

CVE-2024-12214 affects the WooCommerce HSS Extension for Streaming Video (WordPress). The vulnerability is a reflected Cross-Site Scripting (Reflected XSS) via the videolink parameter in all versions up to and including 3.31, caused by insufficient input sanitization and output escaping. Exploita...

CVE-2024-11434 WP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting

The WP – Bulk SMS – by SMS.to plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-11383 CC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The CC Canadian Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cc-mortgage-canada' shortcode in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-12049

CVE-2024-12049 refers to a vulnerability in the WordPress plugin Woo Ukrposhta where a Reflected Cross-Site Scripting (XSS) can be triggered via the order , post , and idd parameters. The issue affects all versions up to and including 1.17.11 and arises from insufficient input sanitization and ou...

CVE-2024-11899

The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11899 Slider Pro Lite <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12098 ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting

The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utmkeyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12098 ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting

The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utmkeyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12590 WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

Joomla! 跨站脚本漏洞

Joomla! is a free, open source content management system open-sourced by Joomla! A security vulnerability exists in Joomla! that stems from a lack of output escaping for the id attribute of a menu list...

PT-2025-1855 · WordPress · Chat Support For Viber

Name of the Vulnerable Software and Affected Versions: Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress versions up to, and including, 1.7.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'vchat'...

PT-2025-1826 · WordPress · Binary Mlm Woocommerce Plugin

Name of the Vulnerable Software and Affected Versions: Binary MLM Woocommerce plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to Cross-Site Request Forgery. It is caused by missing or incorrect nonce validation on the bmw display pv set page function and...

PT-2025-1845 · WordPress · Compare Products For Woocommerce

Name of the Vulnerable Software and Affected Versions: Compare Products for WooCommerce plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is related to Reflected Cross-Site Scripting via the s feature parameter due to insufficient input sanitization and output...