CVE-2024-11372 Connexion Logs <= 3.0.2 - Admin+ SQL Injection

The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-11267

The JSP Store Locator WordPress plugin (versions 1.0 and earlier ) is vulnerable to a SQL injection attack. The root cause is a failure to sanitize and escape a parameter before using it in a SQL statement. This vulnerability allows a user with Contributor privileges to perform unauthorized SQL o...

CVE-2024-10504

The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin, in versions prior to 1.7.1 , is vulnerable to an unauthenticated Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain parameters when they are outputted on a page. This...

PT-2025-21556 · WordPress · Spiritual Gifts Survey

Name of the Vulnerable Software and Affected Versions: Spiritual Gifts Survey WordPress plugin versions 0.9.10 and earlier Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because a parameter is not properly sanitized and escaped before being output back in the...

PT-2025-21419 · WordPress · Ahathat Plugin

Name of the Vulnerable Software and Affected Versions: AHAthat Plugin WordPress plugin versions 1.6 and earlier Description: The issue allows Admin to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement. Recommendations: For...

CVE-2025-2055

The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2025-1986

The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-10638

The Product Labels For Woocommerce Sale Badges WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-12109

The Product Labels For Woocommerce Sale Badges WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-1446

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-1446

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-1446 Pods < 3.2.8.2 - Admin+ SQL Injection

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-1446

CVE-2025-1446 affects Pods – Custom Content Types and Fields (WordPress plugin) prior to version 3.2.8.2. The issue is an SQL injection due to insufficient sanitization/escaping of a parameter before use in a SQL statement, enabling admin-level SQL injection. Connected sources confirm the vulnera...

CVE-2024-13878

The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13881

The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13880

The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13881 LinkMyPosts <= 1.0 - Reflected XSS

The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

RockyLinux 9 : tuned (RLSA-2024:10384)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10384 advisory. tuned: scriptpre and scriptpost options allow to pass arbitrary scripts executed by root CVE-2024-52336 tuned: improper sanitization of instancename...

CVE-2024-13885

The WP e-Customers Beta WordPress plugin (version 0.0.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. This flaw could be leveraged to target high-privilege users, such ...

CVE-2024-13836

The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...