CVE-2024-9236 Team Members Showcase < 4.4.2 - Editor+ Stored XSS

The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9182 Maspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSS

The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-9182

The Maspik WordPress plugin (Advanced Spam Protection) is vulnerable to a Stored Cross-Site Scripting (XSS) attack in versions prior to 2.1.3 . The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability could allow high-privilege users, such as admin...

CVE-2024-8854 Polls CP <= 1.0.75 - Admin+ Stored XSS via Custom Styles

The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multi site setup...

CVE-2024-8854

The Polls CP WordPress plugin (versions prior to 1.0.77 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitise and escape certain poll settings. This flaw allows high-privilege users, such as administrators, to execute malicious scripts, even in environments wh...

CVE-2024-8702

The Backup Database WordPress plugin, in versions prior to 4.9 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to properly sanitise and escape certain settings. This flaw allows high-privilege users, such as administrators, to execute XSS attacks, ev...

CVE-2024-8701 Event Calendar <= 1.0.4 - Admin+ Stored XSS

The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8701

The events-calendar WordPress plugin (versions 1.0.4 and earlier ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack due to insufficient sanitization and escaping of certain settings. This flaw allows high-privilege users, such as administrators, to execute malicious scripts, even in en...

CVE-2024-8851

The Polls CP WordPress plugin before version 1.0.77 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain poll settings. This flaw allows high-privilege users, such as administrators, to execute XSS attacks, even in environments...

CVE-2024-8702 Backup Database <= 4.9 - Admin+ Stored XSS

The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8759 Nested Pages <= 3.2.8 - Editor+ Stored XSS

The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8699

The Z-Downloads WordPress plugin (versions prior to 1.11.5 ) contains a security vulnerability where it fails to properly validate uploaded files. This oversight allows high-privilege users, such as administrators, to upload arbitrary files to the server, even in scenarios where such actions shou...

CVE-2024-8670 Photo Gallery by 10Web < 1.8.29 - Admin+ Stored XSS

The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8619 Ajax Search Lite <= 4.12.2 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8619

The Ajax Search Lite WordPress plugin versions prior to 4.12.3 are vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks...

CVE-2024-8542

The Everest Forms WordPress plugin, in versions prior to 3.0.3.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to execute XSS attacks even i...

CVE-2024-8617

The Quiz Maker WordPress plugin (versions prior to 6.5.9.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to perform XSS attacks, ...

CVE-2024-8493 The Events Calendar < 6.6.4 - Admin+ Stored XSS

The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8619 Ajax Search Lite <= 4.12.2 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8493

The Events Calendar WordPress plugin (versions prior to 6.6.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape specific settings within the plugin. This flaw allows high-privilege users, such as administrators , to perform XSS at...