CVE-2024-12585

CVE-2024-12585 affects the Property Hive WordPress plugin (vulnerable through 2.1.1). The issue is a Reflected XSS: a parameter is output back to the page without proper sanitisation/escaping, enabling an attacker to craft input that could affect high-privilege users (e.g., admins). The Red Hat a...

CVE-2024-12585 PropertyHive < 2.1.1 - Reflected XSS

The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-8857

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

CVE-2024-8857

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

CVE-2024-9638

The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10562

The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10102

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-10102

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-8857

CVE-2024-8857 affects WordPress Auction Plugin (WordPress Auction Plugin) up to version 3.7. The issue is Stored Cross-Site Scripting (XSS) via unsanitized/unchecked plugin settings, allowing an Editor+ (high-privilege) user to inject scripts. Multiple connected sources corroborate the vulnerabil...

CVE-2024-8857 WordPress Auction <= 3.7 - Editor+ Stored XSS

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

CVE-2024-8857 WordPress Auction <= 3.7 - Editor+ Stored XSS

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

PT-2025-1594 · 10Web · The Form Maker

Name of the Vulnerable Software and Affected Versions: The Form Maker by 10Web WordPress plugin versions prior to 1.15.31 Description: The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, for...

CVE-2024-11849

The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11849

CVE-2024-11849 — Pods (WordPress) vulnerable to authenticated Stored XSS due to unsanitized/escaped settings in Pods Custom Content Types and Fields. Affected: Pods plugin for WordPress (prior to or up to 3.2.8) in admin contexts. Impact: high-privilege users (e.g., admins) can inject scripts via...

CVE-2024-11849 Pods – Custom Content Types and Fields < 3.2.8.1 - Admin+ Stored XSS

The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11846

The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-11846

CVE-2024-11846 Travel Tour faces a reflected XSS due to improper sanitization/escaping of a parameter in Travel Tour before output. Affected software: Travel Tour (WordPress plugin) versions prior to 5.2.4. Impact is Reflected XSS potentially exploitable by attackers to run script in context of a...

CVE-2024-11846 Travel Tour < 5.2.4 - Reflected XSS

The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-11846 Travel Tour < 5.2.4 - Reflected XSS

The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-11645

The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...