CVE-2024-12733

The AffiliateImporterEb WordPress plugin (versions 1.0.0 through 1.0.6 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. This vulnerability could be exploited against high-...

CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12732 AffiliateImporterEb <= 1.0.6 - Reflected XSS

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12732 AffiliateImporterEb <= 1.0.6 - Reflected XSS

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12726

The ClipArt WordPress plugin (versions 0.2 and earlier ) is vulnerable to Reflected Cross-Site Scripting (XSS) . This security flaw exists because the application fails to properly sanitise and escape a parameter before outputting it back to the page. An attacker could exploit this to target high...

CVE-2024-12724

The WP DeskLite WordPress plugin (versions 1.0.0 and earlier ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. This vulnerability could be exploited against high-priv...

CVE-2024-12732

The AffiliateImporterEb WordPress plugin (versions 1.0.0 through 1.0.6 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before outputting it back in the page. An attacker can exploit this by sending a crafted reque...

CVE-2024-12725

The Clasify Classified Listing WordPress plugin (versions

CVE-2024-12726 ClipArt <= 0.2 - Reflected XSS

The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12726 ClipArt <= 0.2 - Reflected XSS

The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12724 WP DeskLite <= 1.0.0 - Reflected XSS

The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12716

The Simple Basic Contact Form WordPress plugin (versions prior to 20250114 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS at...

CVE-2024-12680 Prisna GWT < 1.4.14 - Admin+ Stored XSS

The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12679 Prisna GWT < 1.4.14 - Admin+ Stored XSS

The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11843 Panorama – WordPress Project Management Plugin <= 1.5.1 - Admin+ Stored XSS

The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11843 Panorama – WordPress Project Management Plugin <= 1.5.1 - Admin+ Stored XSS

The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11266 Geocache Stat Bar Widget <= 0.911 - Admin+ Stored XSS

The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11190 jwp-a11y <= 4.1.7 - Admin+ Stored XSS

The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11190

The jwp-a11y WordPress plugin (versions 4.1.7 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain settings are not properly sanitised and escaped , allowing high-privilege users, such as administrators, to perform XSS attacks. This vulnerability persi...

CVE-2024-11221

The Full Screen (Page) Background Image Slideshow WordPress plugin (versions 1.1 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability could allow high-privilege users, such as a...