CVE-2024-6797 DL Robots.txt <= 1.2 - Admin+ Stored XSS

The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6798

The DL Verification WordPress plugin (versions 1.2 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This allows high-privilege users, such as administrators, to perform XSS attacks even in env...

CVE-2024-6798 DL Verification <= 1.2 - Admin+ Stored XSS

The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6713

The PVN Auth Popup WordPress plugin (versions 1.0.0 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization and escaping of certain settings. This flaw allows high-privilege users, such as administrators, to execute XSS attacks even in environments where ...

CVE-2024-6719

The Offload Videos – Bunny.net, AWS S3 WordPress plugin, versions prior to 1.0.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF check when updating plugin settings, which could allow low-privilege users to modify these settings via a CSRF attack. I...

CVE-2024-6719 Offload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRF

The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack...

CVE-2024-6719 Offload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRF

The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack...

CVE-2024-6665

The KBucket: Your Curated Content WordPress plugin in versions prior to 4.1.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the lack of sanitization and escaping of certain settings, which allows high-privilege users, such as administrators, to execute malicious scripts. ...

CVE-2024-6665 kbucket < 4.1.6 - Admin+ Stored XSS

The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-6665 kbucket < 4.1.6 - Admin+ Stored XSS

The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6693

The wccp-pro WordPress plugin (versions prior to 15.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as administrators, to perform XSS attacks, even in environment...

CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6462

The DL Yandex Metrika WordPress plugin (versions 1.2 and earlier ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape certain plugin settings, which allows high-privilege users, such as administrators, to perform XSS attacks. ...

CVE-2024-6478 CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS

The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite se...

CVE-2024-5026 CM Tooltip Glossary < 4.3.4 - Admin+ Stored XSS

The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13729 Podlove Podcast Publisher < 4.1.24 - Admin+ Stored XSS

The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13828

The Badgearoo WordPress plugin (versions 1.0.14 and earlier ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitize and escape a parameter before outputting it back onto the page. This flaw could be exploited to target high-privi...

CVE-2024-13828 Badgearoo <= 1.0.14 - Reflected XSS

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13729

The Podlove Podcast Publisher WordPress plugin versions prior to 4.1.24 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is that the plugin fails to properly sanitise and escape certain settings, which could allow high-privilege users, such as administrators, to execute...