CVE-2024-13226

CVE-2024-13226 affects the A5 Custom Login Page WordPress plugin (versions up to 2.8.1). The vulnerability is a reflected cross-site scripting (XSS) caused by insufficient sanitization/escaping of a parameter before it is echoed in the login page. Impact: potential execution of scripts in the con...

CVE-2024-13225

The CVE CVE-2024-13225 affects the ECT Home Page Products WordPress plugin (versions up to 1.9), where a parameter is not sanitized/escaped before being output, enabling a Reflected XSS against high-privilege users (e.g., admins). The CVSS 3.1 base score is 6.1 (UI: REQUIRED; AV:N/AC:L/PR:N/C:L/I...

CVE-2024-13224

CVE-2024-13224 : SlideDeck 1 Lite Content Slider WordPress plugin is affected up to version 1.4.8. The vulnerability is a reflected XSS caused by not sanitising/escaping a parameter before outputting it in the page, potentially affecting high-privilege admin users. Public details confirm the issu...

CVE-2024-13224 SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS

The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13225 ECT Home Page Products <= 1.9 - Reflected XSS

The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13225 ECT Home Page Products <= 1.9 - Reflected XSS

The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13221 Fantastic Elasticsearch <= 4.1.0 - Reflected XSS

The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13220

The CVE-2024-13220 entry describes a Reflected Cross-Site Scripting in the WordPress Google Map Professional (Map In Your Language) plugin (versions &lt;= 1.0) where an input parameter is not sanitized/escaped before being echoed on the page. This could allow an attacker to inject script against ...

CVE-2024-13219 Policy Genius <= 2.0.4 - Reflected XSS

The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13222 User Messages <= 1.2.4 - Reflected XSS

The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13221 Fantastic Elasticsearch <= 4.1.0 - Reflected XSS

The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13222 User Messages <= 1.2.4 - Reflected XSS

The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional Map In Your Language WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13219 Policy Genius <= 2.0.4 - Reflected XSS

The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional Map In Your Language WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13218

CVE-2024-13218 - Fast Tube WordPress plugin : The Fast Tube WordPress plugin (versions up to 2.3.1) is vulnerable to a Reflected Cross-Site Scripting (XSS) due to improper sanitization/escaping of a parameter before it is output on the page. This could allow an attacker to target high-privilege u...

CVE-2024-13219

CVE-2024-13219 is a Reflected XSS in the Privacy Policy Genius WordPress plugin up to version 2.0.4, caused by insufficient sanitisation/escaping of a parameter before output. The issue could impact high-privilege users (e.g., admins) when the vulnerable plugin is active. Publicly available detai...

CVE-2024-13218 Fast Tube <= 2.3.1 - Reflected XSS

The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13112

WP MediaTagger WordPress plugin vulnerability CVE-2024-13112: Reflected XSS in 4.1.1 and earlier where a parameter is not sanitized/escaped before echoing in the page. Could affect admin/high-privilege users. Connected documents confirm the issue but do not publicly specify a patch/version beyond...