CVE-2024-2220: Improper Neutralization of Input During Web Page Generation

The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3917: Improper Neutralization of Input During Web Page Generation

The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-19269 · WordPress · Button Contact Vr Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Button contact VR WordPress plugin versions through 4.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised...

CVE-2024-4289

The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-4289 Sailthru Triggermail <= 1.1 - Reflected XSS

The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-4290 Sailthru Triggermail <= 1.1 - Admin+ Stored XSS

The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4290

The Sailthru Triggermail WordPress plugin (versions

CVE-2024-2189: Improper Neutralization of Input During Web Page Generation

The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example ...

PT-2024-28942 · WordPress · Survey Maker

Name of the Vulnerable Software and Affected Versions: The Survey Maker WordPress plugin versions prior to 4.2.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example,...

PT-2024-30193 · Sailthru · Sailthru Triggermail Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Sailthru Triggermail WordPress plugin versions 1.1 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some of its...

CVE-2024-3580

The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-2697

The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against...

CVE-2024-3580

The Popup4Phone WordPress plugin (versions 1.3.2 and earlier ) contains a Stored Cross-Site Scripting (XSS) vulnerability due to a failure to properly sanitize and escape certain settings. This flaw allows users with elevated privileges, such as Editors , to inject and execute arbitrary JavaScrip...

CVE-2024-3580 Popup4Phone <= 1.3.2 - Editor+ Stored XSS

The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-2744

The NextGEN Gallery WordPress plugin (versions prior to 3.59.1 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a failure to properly sanitize and escape certain settings, which allows high-privilege users, such as administrators, to perform XSS attacks. This remain...

CVE-2024-2744 Nextgen Gallery < 3.59.1 - Admin+ Stored XSS

The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-4263

CVE-2024-4263 describes a broken access control in mlflow/mlflow prior to 2.10.1, where users with EDIT permissions on an experiment can delete artifacts they should only be able to read/update. The issue stems from insufficient validation of DELETE requests for artifact deletions, enabling unaut...

PT-2024-26745 · WordPress · Popup4Phone Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Popup4Phone WordPress plugin versions 1.3.2 and earlier Description: The issue allows high privilege users, such as Editors, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, ...

PT-2024-33109 · Mcafee · Mcafee Epo

Name of the Vulnerable Software and Affected Versions: McAfee ePO affected versions not specified Description: The issue concerns insecure direct object references, allowing a least privileged user to manipulate client tasks and client task assignments. This can lead to privilege escalation, as t...

PT-2024-21897

Name of the Vulnerable Software and Affected Versions The NextGEN Gallery WordPress plugin versions prior to 3.59.1 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not sanitizing...