PT-2024-36817 · WordPress · Tournamatch

Name of the Vulnerable Software and Affected Versions: Tournamatch WordPress plugin versions prior to 4.6.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

PT-2024-35465 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-36308 · WordPress · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 3.59.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered htm...

PT-2024-34672 · WordPress · Sully

Name of the Vulnerable Software and Affected Versions: SULly WordPress plugin versions prior to 4.3.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2024-34404 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

CVE-2024-3112

The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-5626

CVE-2024-5626 affects the Inline Related Posts WordPress plugin prior to version 3.7.0. The issue is that a parameter is not properly sanitized/escaped before being output, causing a Reflected XSS that could target high-privilege users (e.g., admins). The recommended fix is to upgrade to version ...

CVE-2024-5626 Inline Related Posts < 3.7.0 - Reflected XSS

The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-15953 · WordPress · Social Media Widget

Name of the Vulnerable Software and Affected Versions: Social Media Widget WordPress plugin versions prior to 4.0.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for examp...

CVE-2024-39875

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application allows authenticated, low privilege users with the 'Manage own remote connections' permission to retrieve details about other users and group memberships...

CVE-2024-39875

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application allows authenticated, low privilege users with the 'Manage own remote connections' permission to retrieve details about other users and group memberships...

CVE-2024-6334

The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

Cross-site Scripting (XSS)

coderberg/residence-cms is vulnerable to Cross-site Scripting. The vulnerability is due to allowing low-privilege users to create malicious property content with HTML, which acts as a stored XSS payload...

CVE-2024-2375

The CVE covers the WordPress plugin WPQA Builder (Builder forms Addon) prior to version 6.1.1. The issue arises from insufficient sanitisation/escaping of some Slider settings, enabling Stored XSS when exploited by high-privilege users (e.g., contributors). Affected versions are before 6.1.1; rem...

CVE-2024-3999 EazyDocs < 2.5.0 - Admin+ Stored XSS

The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3999 EazyDocs < 2.5.0 - Admin+ Stored XSS

The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-28757 · WordPress · Eazydocs

Name of the Vulnerable Software and Affected Versions: EazyDocs WordPress plugin versions prior to 2.5.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escape...

CVE-2024-6130

The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6130

The CVE-2024-6130 entry concerns The Form Maker by 10Web WordPress plugin prior to version 1.15.26, where certain settings are not properly sanitised/escaped. The Red Hat and CVE databases confirm this can enable Stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disa...

CVE-2024-5729

The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...