PT-2024-36726

Name of the Vulnerable Software and Affected Versions Astro versions v5.0.3 through v5.0.7 Astro versions 4.16.17 and earlier Astro versions 5.0.8 and earlier Description A flaw exists in the build process of Astro, a web framework for content-driven websites, allowing unauthenticated users to...

WordPress plugin AutomatorWP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site...

CVE-2024-12449

CVE-2024-12449 affects the Video Share VOD – Turnkey Video Site Builder Script WordPress plugin. It is a Stored XSS in the videowhisper_player_html shortcode present in all versions up to 2.6.30 due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation r...

CVE-2024-11748 Taeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-17635 · WordPress · Contests By Rewards Fuel

Name of the Vulnerable Software and Affected Versions: Contests by Rewards Fuel plugin for WordPress versions up to, and including, 2.0.65 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'RF CONTEST' shortcode due to insufficient input sanitization and output...

WordPress plugin Contests by Rewards Fuel 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin ScanCircle 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site...

WordPress plugin Philantro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Video Share VOD 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

CVE-2024-12395 WooCommerce Additional Fees On Checkout (Free) <= 1.4.7 - Reflected Cross-Site Scripting via 'number'

The WooCommerce Additional Fees On Checkout Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-12395 WooCommerce Additional Fees On Checkout (Free) <= 1.4.7 - Reflected Cross-Site Scripting via 'number'

The WooCommerce Additional Fees On Checkout Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-12395

CVE-2024-12395 is a Reflected Cross-Site Scripting flaw in the WordPress plugin “WooCommerce Additional Fees On Checkout (Free)” that affects all versions up to 1.4.7. The root cause is insufficient input sanitization and output escaping on the “number” parameter, enabling unauthenticated attacke...

CVE-2024-12024

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the emticketcategorydata and emticketindividualdata parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping. Thi...

CVE-2024-12469 WP BASE Booking of Appointments, Services and Events <= 4.9.1 - Reflected Cross-Site Scripting via status Parameter

The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘status’ parameter in all versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2024-12469

CVE-2024-12469 affects the WP BASE Booking of Appointments, Services and Events WordPress plugin. It is a Reflected Cross-Site Scripting vulnerability via the status parameter, caused by insufficient input sanitization/output escaping, exploitable by unauthenticated attackers who lure a user into...

CVE-2024-12127

CVE-2024-12127 — Sikshya LMS (WordPress plugin) is affected by a reflected XSS via the page parameter in versions up to 0.0.21 due to insufficient input sanitization and output escaping. This can allow unauthenticated attackers to inject scripts into pages that run when a user interacts (e.g., cl...

CVE-2024-12024

CVE-2024-12024 : EventPrime – Events Calendar, Bookings and Tickets (WordPress) is vulnerable to Stored Cross-Site Scripting via em_ticket_category_data and em_ticket_individual_data in all versions up to and including 4.0.5.3. Exploitation requires the Guest Submissions setting to be enabled. If...

CVE-2024-12127 Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parameter

The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 0.0.21 due to insufficient input sanitization and output escaping. This...

CVE-2024-12239

CVE-2024-12239 (PowerPack Lite for Beaver Builder, WordPress) is a Reflected Cross-Site Scripting flaw in the navigate parameter, affecting all versions up to 1.3.0.5. It allows unauthenticated attackers to inject scripts that run when an admin user interacts with a crafted link. The Red Hat entr...

CVE-2024-12239 PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter

The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all versions up to, and including, 1.3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...