CVE-2024-6529

CVE-2024-6529 is a Reflected XSS in the Ultimate Classified Listings WordPress plugin prior to version 1.4. Public sources in connected documents confirm the vulnerability arises from insufficient sanitisation/escaping of a parameter before output. The Red Hat advisory reiterates the same descrip...

CVE-2024-6529 Ultimate Classified Listings < 1.4 - Reflected XSS

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-4090 My Sticky Bar < 2.7.2 - Admin+ Stored XSS

The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredht...

CVE-2024-2872

The CVE-2024-2872 entry concerns the socialdriver-framework WordPress plugin, affected versions prior to 2024.04.30. The root cause is inadequate sanitisation and escaping of certain settings, enabling stored XSS by high-privilege users (e.g., Contributors), even when unfiltered_html is disallowe...

CVE-2024-2872 Swift Framework < 2024.04.30 - Contributor+ Stored XSS

The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

PT-2024-29134 · WordPress · The Floating Notification Bar

Name of the Vulnerable Software and Affected Versions: The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin versions prior to 2.7.2 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting...

CVE-2024-6272 SpiderContacts <= 1.1.7 - Reflected XSS

The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-37500 · WordPress · Spidercontacts

Name of the Vulnerable Software and Affected Versions: The SpiderContacts WordPress plugin versions 1.1.7 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in t...

PT-2024-37602 · 10Web · The Slider By 10Web

Name of the Vulnerable Software and Affected Versions: The Slider by 10Web WordPress plugin versions prior to 1.2.57 Description: The issue allows high privilege users, such as editors and above, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the lack of...

CVE-2024-6536

The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-6223

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5807

The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations...

CVE-2024-5807

The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations...

CVE-2024-6226

CVE-2024-6226 relates to the WpStickyBar WordPress plugin (versions up to 2.1.0). It describes a reflected XSS flaw where a user-supplied parameter is not properly sanitized/escaped before being echoed on a page. The impact is described as allowing an attacker to target high-privilege users (e.g....

CVE-2024-6536 Zephyr Project Manager < 3.3.99 - Editor+ XSS

The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-6223 Send email only on Reply to My Comment <= 1.0.6 - Reflected XSS

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6223

CVE-2024-6223 corresponds to a Reflected XSS in the WordPress plugin Send email only on Reply to My Comment, affecting versions up to 1.0.6. The issue arises from insufficient sanitisation/escaping of a parameter before output, enabling an attacker to inject script that could execute in a privile...

CVE-2024-4096

CVE-2024-4096 affects the WordPress plugin Responsive Tabs (versions up to 4.0.8). The vulnerability is aStored Cross-Site Scripting (XSS) caused by insufficient sanitization/escaping of certain Tab settings, potentially enabling a high-privilege user (Contributor+) to inject scripts. Public deta...

CVE-2024-4096 Responsive Tabs <= 4.0.8 - Contributor+ Stored XSS

The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks...

PT-2024-37463 · WordPress · Send Email Only On Reply To My Comment

Name of the Vulnerable Software and Affected Versions: Send email only on Reply to My Comment WordPress plugin versions 1.0.0 through 1.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before bei...