CVE-2024-5728 Animated AL List <= 1.0.6 - Reflected XSS

The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5729

The Simple AL Slider WordPress plugin, in versions prior to 1.2.11 (through 1.2.10), is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape a parameter before it is outputted back onto the page. This vulnerability could be leveraged to ...

CVE-2024-5728

The Animated AL List WordPress plugin, affecting versions through 1.0.6 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The issue arises because the plugin fails to sanitize and escape a parameter before outputting it back to the page. This vulnerability could be targeted against high-p...

CVE-2024-5729 Simple AL Slider <= 1.2.10 - Reflected XSS

The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5727

The Widget4Call WordPress plugin, in versions 1.0.0 through 1.0.7 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is output back to the page. This vulnerability could be exploited against high-privilege ...

PT-2024-37103 · WordPress · Widget4Call

Name of the Vulnerable Software and Affected Versions: Widget4Call WordPress plugin versions 1.0.0 through 1.0.7 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

PT-2024-37105 · WordPress · Simple Al Slider

Name of the Vulnerable Software and Affected Versions: Simple AL Slider WordPress plugin versions prior to 1.2.11 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

CVE-2024-5730: Improper Neutralization of Input During Web Page Generation

The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-37106 · WordPress · Pagerank Tools

Name of the Vulnerable Software and Affected Versions: Pagerank tools WordPress plugin versions 1.1.5 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

CVE-2024-4664: Improper Neutralization of Input During Web Page Generation

The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-5573

The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-5473

The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5169

The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5573 Easy Table of Contents < 2.0.66 - Admin+ Stored XSS

The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-5473 Simple Photoswipe <= 0.1 - Admin+ Stored XSS

The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5473

The Simple Photoswipe WordPress plugin, affecting versions

CVE-2024-5169

CVE-2024-5169 affects the Video Widget WordPress plugin (versions ≤ 1.2.3). The vulnerability arises from insufficient sanitisation/escaping of widget settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Public‑facing advi...

PT-2024-34836 · WordPress · Video Widget

Name of the Vulnerable Software and Affected Versions: Video Widget WordPress plugin versions 1.2.3 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

CVE-2024-4957: Improper Neutralization of Input During Web Page Generation

The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-33557 · WordPress · Frontend Checklist

Name of the Vulnerable Software and Affected Versions: Frontend Checklist WordPress plugin versions prior to 2.3.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...