CVE-2024-8542 Everest Forms < 3.0.3.1 - Admin+ Stored XSS

The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8493 The Events Calendar < 6.6.4 - Admin+ Stored XSS

The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8617

The Quiz Maker WordPress plugin is vulnerable prior to version 6.5.9.9 due to insufficient sanitization/escaping of certain settings, enabling Stored XSS for high-privilege users (e.g., admins) even when unfiltered_html is disallowed (including multisite). Affected versions include 6.5.9.8 and ea...

CVE-2024-8619

The CVE-2024-8619 entry concerns the WordPress plugin Ajax Search Lite, affected version(s) prior to 4.12.3. The root cause is inadequate sanitisation/escaping of certain settings, which could enable a stored cross-site scripting (Stored XSS) attack by high-privilege users (e.g., admins) even whe...

CVE-2024-8492 Hustle < 7.8.5 - Admin+ Stored XSS

The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-8492

The Hustle WordPress plugin (≤ 7.8.5) is vulnerable to Admin+ Stored XSS due to insufficient sanitisation/escaping of certain settings, enabling high-privilege users (e.g., editors) to execute scripts even with unfiltered_html disallowed. Impact is limited to XSS within the plugin context; no exp...

CVE-2024-8426 Pagelayer < 1.8.8 - Admin+ Stored XSS

The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-8492 Hustle < 7.8.5 - Admin+ Stored XSS

The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-8284 Download Manager <= 3.2.98 - Admin+ Stored XSS

The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-8187

The CVE-2024-8187 entry affects the Smart Post Show WordPress plugin (versions

CVE-2024-8187 Smart Post Show <= 3.0.0 - Editor+ Stored XSS

The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8284 Download Manager <= 3.2.98 - Admin+ Stored XSS

The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-8284

CVE-2024-8284 affects the WordPress plugin Download Manager (versions before 3.2.99). The issue stems from insufficient sanitisation/escaping of certain settings, enabling stored XSS by high-privilege users (e.g., editors) even when unfiltered_html is disallowed. Red Hat’s advisory aligns with th...

CVE-2024-7759 PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-7759 PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-7769

The CVE-2024-7769 entry covers the ClickSold IDX WordPress plugin up to version 1.90, where a Stored Cross-Site Scripting vulnerability exists due to insufficient sanitisation/escaping of settings. This could allow high-privilege users (e.g., admins) to trigger XSS even when unfiltered_html is di...

CVE-2024-7758 Stylish Price List < 7.1.8 - Contributor+ Stored XSS

The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite set...

CVE-2024-7758 Stylish Price List < 7.1.8 - Contributor+ Stored XSS

The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite set...

CVE-2024-7758

CVE-2024-7758 — WordPress Stylish Price List plugin : The plugin before version 7.1.8 does not adequately sanitize and escape certain settings, enabling potential stored XSS for high-privilege users (contributors and above) even when the unfiltered_html capability is disallowed (e.g., in multisit...

CVE-2024-7769 Wordpress Clicksold IDX Plugin <= 1.90 - Admin+ XSS

The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...