CVE-2024-6226

The WpStickyBar WordPress plugin (versions prior to 2.1.1 , including through 2.1.0) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. This flaw could be exploited to target ...

CVE-2024-6536 Zephyr Project Manager < 3.3.99 - Editor+ XSS

The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-6223

The Send email only on Reply to My Comment WordPress plugin (versions 1.0.0 through 1.0.6 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before outputting it back into the page. This vulnerability could be exploi...

CVE-2024-6223 Send email only on Reply to My Comment <= 1.0.6 - Reflected XSS

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-4096

The Responsive Tabs WordPress plugin (versions 4.0.8 and earlier ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitize and escape certain Tab settings provided by the user. This flaw allows users with high privileges, such as Cont...

CVE-2024-4096 Responsive Tabs <= 4.0.8 - Contributor+ Stored XSS

The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks...

PT-2024-27129 · WordPress · Web Directory Free Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Web Directory Free WordPress plugin versions prior to 1.7.2 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in...

CVE-2024-3113: Improper Neutralization of Input During Web Page Generation

The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...

PT-2024-29175 · WordPress · Responsive Tabs

Name of the Vulnerable Software and Affected Versions: Responsive Tabs WordPress plugin versions 4.0.8 and earlier Description: The issue allows high privilege users, such as Contributors and above, to perform Stored Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some ...

CVE-2024-3669: Improper Neutralization of Input During Web Page Generation

The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-37463 · WordPress · Send Email Only On Reply To My Comment

Name of the Vulnerable Software and Affected Versions: Send email only on Reply to My Comment WordPress plugin versions 1.0.0 through 1.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before bei...

CVE-2024-3986: Improper Neutralization of Input During Web Page Generation

The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5883

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5883 Ultimate Classified Listings < 1.3 - Reflected XSS

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5883

The Ultimate Classified Listings WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 1.3 . The root cause is a failure to properly sanitize and escape a parameter before it is outputted back to the page. This vulnerability can be exploited against high-priv...

PT-2024-29565 · Byond +1 · Byond +1

Name of the Vulnerable Software and Affected Versions: tgstation-server versions prior to 6.8.0 Description: The issue allows low permission users with the "Set .dme Path" privilege to potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files...

PT-2024-37380 · WordPress · Wp Ulike

Name of the Vulnerable Software and Affected Versions: WP ULike WordPress plugin versions prior to 4.7.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

CVE-2024-6094: Improper Neutralization of Input During Web Page Generation

The WP ULike WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4260

The Page Builder Gutenberg Blocks (also known as CoBlocks ) WordPress plugin, in versions prior to 3.1.12 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the plugin's failure to prevent users from pinging arbitrary hosts via specific shortcodes . This flaw allows high-...

CVE-2024-4260 CoBlocks < 3.1.12 - Contributor+ SSRF

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks...