CVE-2024-11221

The CVE-2024-11221 entry concerns the WordPress plugin Full Screen (Page) Background Image Slideshow, version

CVE-2024-11266 Geocache Stat Bar Widget <= 0.911 - Admin+ Stored XSS

The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11190

CVE-2024-11190 covers the jwp-a11y WordPress plugin (versions

CVE-2024-11140

CVE-2024-11140 affects the Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin (

CVE-2024-11109

The WP Google Review Slider WordPress plugin before version 15.6 does not sanitize and escape some settings, allowing high-privilege users (e.g., admins) to perform Stored Cross-Site Scripting even when unfiltered_html is disallowed (including multisite setups). Affected component: plugin setting...

CVE-2024-10639 Auto Prune Posts < 3.0.0- Admin+ Stored XSS

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10632

The CVE-2024-10632 entry concerns the Nokaut Offers Box WordPress plugin (versions 1.4.0 and earlier). The underlying issue is that the plugin does not sanitize and escape certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as...

CVE-2024-10639

Summary. CVE-2024-10639 concerns the WordPress plugin Auto Prune Posts (pre-3.0.0). Multiple connected sources confirm the root cause: the plugin does not adequately sanitize and escape certain settings, enabling a Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is dis...

CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed f...

CVE-2024-10362

CVE-2024-10362 affects the WordPress plugin Social Media Share Buttons & Social Sharing Icons (versions before 2.9.1). The issue is improper sanitization/escaping of certain plugin settings, potentially allowing stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disall...

CVE-2024-10149 Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets

The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10149

The CVE-2024-10149 entry concerns the WordPress Social Slider Feed plugin prior to version 2.2.9. The root cause is that certain settings are not properly sanitized or escaped, enabling Stored XSS by high‑privilege users (e.g., administrators) even when unfiltered_html is disallowed (such as in m...

CVE-2024-10145

Summary: Hubbub Lite WordPress plugin before 1.34.4 is vulnerable to Stored XSS via unsanitized/uncleaned settings. Affected: Hubbub Lite WP plugin

CVE-2024-10107

CVE-2024-10107 affects the WordPress plugin Giveaways and Contests by RafflePress (versions prior to 1.12.17). The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitisation/escaping of certain plugin settings, allowing high-privilege users (e.g., Admin) to inje...

CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10143

CVE-2024-10143 affects the MB Custom Post Types & Custom Taxonomies WordPress plugin, prior to version 2.7.7. The issue arises from inadequate sanitisation/escapes of certain settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins) even when unfiltered_html is disallo...

CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10145 Hubbub Lite < 1.34.4 - Admin+ Stored XSS

The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10144 Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-10144

CVE-2024-10144 affects the Photo Gallery, Images, Slider in the Rbs Image Gallery WordPress plugin (pre-3.2.22). The issue is inadequate sanitization/escaping of certain settings, enabling a high-privilege user (e.g., contributor) to perform a Stored XSS attack even when unfiltered_html is disall...