CVE-2024-6158: Improper Neutralization of Input During Web Page Generation

The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high...

CVE-2024-6133: Improper Neutralization of Input During Web Page Generation

The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6134 WP eStore < 8.5.6 - Reflected XSS in Product Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6134

The wp-cart-for-digital-products WordPress plugin (also identified as WP eStore ) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 8.5.6 . The root cause is a failure to sanitize and escape a specific parameter before outputting it back to the page. This flaw could be ex...

CVE-2024-6134 WP eStore < 8.5.6 - Reflected XSS in Product Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-37409 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

CVE-2024-6133 WP eStore < 8.5.6 - Reflected XSS in Customer Search

The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-37408 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.6 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

CVE-2024-6481: Improper Neutralization of Input During Web Page Generation

The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3973 House Manager <= 1.0.8.4 - Reflected XSS

The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-28654

Name of the Vulnerable Software and Affected Versions The House Manager WordPress plugin versions 1.0.8.4 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This...

BIT-WORDPRESS-2024-3992

The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

BIT-WORDPRESS-MULTISITE-2024-3992

The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6651

The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6651

The WordPress File Upload plugin (versions before 4.24.8 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape the 'dir' parameter in the file browser page before outputting it back to the user. Attackers can exploit this by crafti...

PT-2024-37778

Name of the Vulnerable Software and Affected Versions WordPress File Upload WordPress plugin versions prior to 4.24.8 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in th...

CVE-2024-3636

The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-37672

Name of the Vulnerable Software and Affected Versions The Chatbot for WordPress by Collect.chat versions prior to 2.4.4 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

PT-2024-37498 · WordPress · Community Events

Name of the Vulnerable Software and Affected Versions: Community Events WordPress plugin versions prior to 1.5.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and...

CVE-2024-6498: Improper Neutralization of Input During Web Page Generation

The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...