CVE-2024-8968

The MaxButtons WordPress plugin (versions prior to 9.8.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to the failure to properly sanitize and escape certain settings, specifically related to the text color configuration. This vulnerability allows high-privilege users, such as administ...

CVE-2024-10706

The Download Manager WordPress plugin, in versions prior to 3.3.03 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as administrators, to perform XSS attacks, ...

CVE-2024-10706 Download Manager < 3.3.03 - Admin+ Stored XSS

The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10555

The MaxButtons WordPress plugin (versions before 9.8.1 ) contains a vulnerability where it fails to properly sanitise and escape certain settings, specifically related to button width . This flaw allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) att...

CVE-2024-10706: Improper Neutralization of Input During Web Page Generation

The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10939

The Image Widget WordPress plugin, in versions prior to 4.4.11 , contains a vulnerability where certain widget settings are not properly sanitized or escaped . This flaw allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks. Notably, this remain...

CVE-2024-10939 Image Widget < 4.4.11 - Admin+ Stored XSS

The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-16651 · WordPress · Image Widget

Name of the Vulnerable Software and Affected Versions: Image Widget WordPress plugin versions prior to 4.4.11 Description: The issue concerns the Image Widget WordPress plugin, where certain settings of its Image Widget are not properly sanitized and escaped. This could allow high-privilege users...

CVE-2024-9428

The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9641

The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9881

The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10517

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti...

CVE-2024-10010

The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9641 LuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSS

The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9881

The LearnPress WordPress plugin (versions prior to 4.2.7.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization and escaping of certain settings. This flaw allows high-privilege users, such as administrators, to execute XSS attacks, notably even in environments wh...

CVE-2024-10568 Ajax Search Lite < 4.12.4 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9428

The Popup Builder WordPress plugin (versions prior to 4.3.5 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitize and escape certain plugin settings. This allows high-privilege users, such as administrators, to execute XSS attacks even in ...

CVE-2024-10518

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin versions prior to 4.15.15 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain Membership Plan settings...

CVE-2024-10517

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin (also known as ProfilePress ) is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 4.15.15 . The root cause is a failure to properly sanitize and escape c...

CVE-2024-10010

The LearnPress WordPress plugin (versions prior to 4.2.7.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly sanitize and escape certain settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks even when the unfiltered_html ca...