CVE-2024-9662 CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings

The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9236

The Team WordPress plugin (versions prior to 4.4.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack due to a failure to properly sanitise and escape some of its settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks even in environments where ...

CVE-2024-8854

The Polls CP WordPress plugin (versions prior to 1.0.77 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain poll settings, which allows high-privilege users, such as administrators, to execute malicious scripts. This vulnera...

CVE-2024-9227 PowerPress Podcasting < 11.9.18 - Author+ XSS

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-8702 Backup Database <= 4.9 - Admin+ Stored XSS

The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8426

The Page Builder: Pagelayer WordPress plugin is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in versions prior to 1.8.8 . The root cause is the failure to properly sanitise and escape certain plugin settings, which could allow high-privilege users, such as administrators , to execute ma...

CVE-2024-8398

The Simple Nav Archives WordPress plugin, in versions 2.1.3 and earlier , is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when updating settings. An attacker could potentially force a logged-in administrator to modify the plugin's settings. Remediation req...

CVE-2024-8031

The Secure Downloads WordPress plugin (versions prior to 1.2.3 ) contains a vulnerability where it fails to properly restrict which files can be downloaded. This allows authenticated attackers with admin-level access and above to download arbitrary files on the server, which may contain highly se...

CVE-2024-7556 Wordpress Simple Share Plugin <=0.5.3 - Admin+ XSS

The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6462 DL Yandex Metrika <= 1.2 - Admin+ Stored XSS

The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13828

The Badgearoo WordPress plugin, in versions 1.0.14 and earlier , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape a parameter before it is outputted back to the page. This vulnerability could be exploited to target high-pr...

CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13382 Calculated Fields Form < 5.2.64 - Admin+ Stored XSS

The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13357

The Ditty WordPress plugin versions prior to 3.1.52 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This vulnerability allows high-privilege users, such as those with Author permissions, to execute stored ...

CVE-2024-13313

The AWeber WordPress plugin versions 7.3.20 and earlier is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to execute scripts. This vulnerability ca...

CVE-2024-13128 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13127 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12770

The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...