CVE-2024-13128

The LearnPress WordPress plugin in versions prior to 4.2.7.5.1 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain settings within the plugin. This flaw allows high-privilege users, such as administrators, to perform XSS attac...

CVE-2024-13127 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12874

The Top Comments WordPress plugin (versions

CVE-2024-13127 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13127

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 4.2.7.5.1 . The root cause is the failure to properly sanitize and escape certain settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks, even in enviro...

CVE-2024-12874 Top Comments <= 1.0 - Admin+ Stored Cross-Site Scripting

The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12873

The Custom Field Manager WordPress plugin (version 1.0 and below) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitise and escape a parameter before outputting it back to the page. This flaw allows an attacker to execute scripts in the browsers of high...

CVE-2024-12808

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin versions prior to 1.13.4 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the lack of sanitization and escaping of certain settings within the plugin. This vulne...

CVE-2024-12808 WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the...

CVE-2024-12808 WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the...

CVE-2024-12800 IP Based Login < 2.4.1 - Admin+ Stored XSS

The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12770

The WP ULike WordPress plugin (versions prior to 4.7.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain settings within the plugin. This security flaw allows users with high privileges, such as administrators , to perform...

CVE-2024-12770 WP ULike < 4.7.6 - Admin+ Stored XSS

The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12734 Advance Post Prefix <= 1.1.1 - Reflected XSS

The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12734

The Advance Post Prefix WordPress plugin (versions through 1.1.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape a parameter before outputting it back to the page. An attacker can exploit this by sending a crafted request to ...

CVE-2024-12743

The MailPoet WordPress plugin (versions prior to 5.5.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack due to a failure to properly sanitize and escape certain settings. This flaw allows high-privilege users, such as administrators, to execute malicious scripts, even in environments...

CVE-2024-12739

The Mobile Contact Bar WordPress plugin (versions prior to 3.0.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to perform XSS att...

CVE-2024-12733 AffiliateImporterEb <= 1.0.6 - Reflected XSS via Search

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12734 Advance Post Prefix <= 1.1.1 - Reflected XSS

The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...