CVE-2024-11109

The WP Google Review Slider WordPress plugin (versions prior to 15.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to execute XSS...

CVE-2024-11140

The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin, in versions 2.0.8 and earlier , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape certain settings. This allows high-privilege users, such as administra...

CVE-2024-10639

The Auto Prune Posts WordPress plugin versions prior to 3.0.0 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability can be exploited by high-privilege users, such as administrators, ev...

CVE-2024-10639 Auto Prune Posts < 3.0.0- Admin+ Stored XSS

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10632

The Nokaut Offers Box WordPress plugin (versions 1.4.0 and earlier ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to execute malici...

CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed f...

CVE-2024-10149 Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets

The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10362

The Social Media Share Buttons & Social Sharing Icons WordPress plugin, in versions prior to 2.9.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as administr...

CVE-2024-10149

The Social Slider Feed WordPress plugin versions prior to 2.2.9 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks, even in envir...

CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10144

The Rbs Image Gallery WordPress plugin (versions prior to 3.2.22 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape certain plugin settings, which allows high-privilege users, such as contributors , to perform XSS attacks. T...

CVE-2024-10143

The MB Custom Post Types & Custom Taxonomies WordPress plugin versions prior to 2.7.7 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to execute ...

CVE-2024-10145

The Hubbub Lite WordPress plugin versions prior to 1.34.4 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitize and escape certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to perform XSS attack...

CVE-2024-10144 Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-10145 Hubbub Lite < 1.34.4 - Admin+ Stored XSS

The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10107

The Giveaways and Contests by RafflePress WordPress plugin versions prior to 1.12.17 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to execute m...

CVE-2024-13482: Improper Neutralization of Input During Web Page Generation

The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-21450 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress WordPress plugin versions prior to 4.2.7.5.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed,...

PT-2025-21530 · Unknown · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads WordPress plugin versions prior to 1.11.5 Description: The issue allows high privilege users, such as admin, to upload arbitrary files on the server even when they should not be allowed to, for example in a multisite setup. This i...