CVE-2024-13382

CVE-2024-13382 – Calculated Fields Form (WordPress) is a stored XSS vulnerability in versions before 5.2.64 caused by insufficient sanitization/escaping of certain settings. Exploitation requires authenticated admin-level access (Admin+), and can occur even when unfiltered_html is disallowed (e.g...

CVE-2024-13313

CVE-2024-13313 affects the AWeber WordPress plugin up to version 7.3.20. The issue arises from unsanitised/uncleaned settings in the plugin, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, such as in multisite setups. Public sources identify the...

CVE-2024-13128

The CVE-2024-13128 entry concerns the LearnPress WordPress plugin prior to version 4.2.7.5.1. According to the provided documents, the vulnerability arises because the plugin does not sanitize and escape certain settings, which could allow high-privilege users (e.g., admins) to perform a Stored C...

CVE-2024-13313 AWeber <= 7.3.20 - Admin+ Stored XSS

The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13127 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12874 Top Comments <= 1.0 - Admin+ Stored Cross-Site Scripting

The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13127 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12874

The CVE-2024-12874 entry concerns the WordPress plugin Top Comments, affected up to version 1.0. The issue is caused by insufficient sanitization/escaping of certain settings, enabling Stored XSS by high-privilege admins (e.g., in multisite) even when unfiltered_html is disallowed. Public exploit...

CVE-2024-13127

CVE-2024-13127 concerns the LearnPress WordPress LMS Plugin prior to 4.2.7.5.1. The vulnerability arises because the plugin does not sanitize and escape certain settings, enablingStored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins) in multisite scenarios even when unfil...

CVE-2024-12808 WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the...

CVE-2024-12808 WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the...

CVE-2024-12808

The CVE-2024-12808 entry concerns the WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin (versions before 1.13.4). According to connected documents, the vulnerability is a Stored Cross-Site Scripting (Stored XSS) flaw caused by insufficie...

CVE-2024-12873

The CVE-2024-12873 entry concerns the WordPress plugin Custom Field Manager (versions up to 1.0). The root cause is that the plugin does not sanitize and escape a parameter before echoing it back in the page, producing a reflected XSS. Impact is described as enabling script execution in admin or ...

CVE-2024-12770

CVE-2024-12770 affects the WP ULike WordPress plugin (versions before 4.7.6). An attacker with high privileges (e.g., admin) can trigger a Stored Cross-Site Scripting vulnerability due to unsanitized/escaped settings, even when unfiltered_html is disallowed (e.g., multisite). Impact per provided ...

CVE-2024-12800 IP Based Login < 2.4.1 - Admin+ Stored XSS

The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12770 WP ULike < 4.7.6 - Admin+ Stored XSS

The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12733

The CVE-2024-12733 entry applies to the AffiliateImporterEb WordPress plugin (versions 1.0.0–1.0.6). The vulnerability is a Reflected Cross-Site Scripting caused by insufficient sanitisation/escaping of an input parameter before echoing it on the page, with impact described as exploitable against...

CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12734

The CVE-2024-12734 entry covers the Advance Post Prefix WordPress plugin (versions through 1.1.1). Affected component: the plugin’s parameter output path where unsanitized/unescaped input is echoed back in the page, causing a Reflected Cross-Site Scripting (XSS) vulnerability. Root cause: imprope...

CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...