4585 matches found
CVE-2024-13329 Solidres <= 0.9.4 - Reflected XSS
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13328
CVE-2024-13328 affects the WordPress plugin “Giga Messenger – Express” (Giga Messenger) up to version 2.3.1. The connected documents confirm a vulnerability where a parameter is not sanitised or escaped before being echoed back on the page, resulting in a Reflected Cross-Site Scripting (XSS) vuln...
CVE-2024-13327
The CVE covers the Musicbox WordPress plugin (versions 2.0.3 and earlier). A Reflected XSS occurs due to lack of sanitization and escaping of a parameter before it’s output on the page, enabling script execution in the context of high-privilege users (e.g., admins). The Nuclei template confirms t...
CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS
The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13327 Musicbox <= 2.0.3 - Reflected XSS
The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13326
CVE-2024-13326 affects the iBuildApp WordPress plugin (versions up to 0.2.0). The issue is a reflected cross-site scripting (XSS) caused by insufficient sanitization/escaping of a parameter before echoing it to the page, enabling an attacker to trick high-privilege users (e.g., admins) into execu...
CVE-2024-13327 Musicbox <= 2.0.3 - Reflected XSS
The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS
The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13325 Glossy <= 2.3.5 - Reflected XSS
The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13114 WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13114
CVE-2024-13114 relates to the WordPress plugin “WP Projects Portfolio with Client Testimonials” (versions
PT-2025-2118 · WordPress · Transfinanz Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: TransFinanz WordPress plugin version 1.0.0 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...
PT-2025-2111
Name of the Vulnerable Software and Affected Versions Glossy WordPress plugin versions 2.3.5 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be use...
PT-2025-2116
Name of the Vulnerable Software and Affected Versions JustRows free WordPress plugin versions 0.2 and earlier Description The issue arises from the plugin not sanitising and escaping a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. This could be used...
CVE-2024-13099
The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13098
The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13098
The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13097
The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13098 WP Email Newsletter <= 1.1 - Reflected XSS
The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...