CVE-2024-13357

CVE-2024-13357 affects the Ditty WordPress plugin prior to version 3.1.52. The vulnerability arises from insufficient sanitisation/escaping of certain settings, enabling stored cross-site scripting by high-privilege users (e.g., authors), even when unfiltered_html is disallowed (such as in multis...

CVE-2024-13313

CVE-2024-13313 affects the AWeber WordPress plugin up to version 7.3.20. The issue arises from unsanitised/uncleaned settings in the plugin, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, such as in multisite setups. Public sources identify the...

CVE-2024-13128 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13127 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12770

CVE-2024-12770 affects the WP ULike WordPress plugin (versions before 4.7.6). An attacker with high privileges (e.g., admin) can trigger a Stored Cross-Site Scripting vulnerability due to unsanitized/escaped settings, even when unfiltered_html is disallowed (e.g., multisite). Impact per provided ...

CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12716

The CVE-2024-12716 entry concerns the WordPress plugin Simple Basic Contact Form prior to 20250114. Affected: the plugin’s settings are not properly sanitized/escaped, enabling Stored Cross-Site Scripting (XSS) by high-privilege users (e.g., admins). Impact is possible even when unfiltered_html i...

CVE-2024-12282 WordPress连接微博 <= 2.5.6 - Stored XSS via CSRF

The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-11718 tarteaucitron.js for WordPress < 0.3.0 - Author+ Stored XSS

The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-11190 jwp-a11y <= 4.1.7 - Admin+ Stored XSS

The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11140 Real WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Admin+ Stored XSS

The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for exampl...

CVE-2024-10504

CVE-2024-10504 affects the WordPress plugin Contact Form, Survey, Quiz & Popup Form Builder (ARForms Builder) , specifically versions prior to 1.7.1 . The issue is an improper sanitisation/escaping of certain parameters when they are output on a page, enabling unauthenticated users to perform Cro...

CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10075 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution

The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block...

CVE-2024-10054 Happyforms < 1.26.3 - Admin+ Stored XSS

The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin TI WooCommerce Wishlist versions = 2.10.0...

WordPress Responsive Lightbox & Gallery plugin < 2.5.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Responsive Lightbox versions 2.5.1...

WordPress TicketBAI Facturas para WooCommerce plugin <= 3.18 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by CVEhunter in WordPress Plugin TicketBAI Facturas para WooCommerce versions = 3.18...

CVE-2025-4473

The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajaxrequest function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends...

CVE-2024-13914

The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 file-manager-advanced-shortcode and 2.5.6 advanced-file-manager-pro-premium, via the 'filemanageradvanced' shortcode. This makes it possible for authenticated...