CVE-2024-13836

CVE-2024-13836 affects the WordPress plugin WP Login Control, version ≤ 2.0.0. The vulnerability is a reflected XSS caused by insufficient sanitization/escaping of a parameter before it is echoed on the page, which could be leveraged against high-privilege users (e.g., admins). The connected docu...

CVE-2024-13836 WP Login Control <= 2.0.0 - Reflected XSS

The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13574 XV Random Quotes <= 1.40 - Reflected XSS

The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13574

CVE-2024-13574 – XV Random Quotes (WordPress) ≤ 1.40 : The vulnerability arises from insufficient sanitization/escaping of an input parameter before echoing it in the page, causing a reflected XSS that could target high-privilege users (e.g., admins). Public details about a fix/patch version are ...

CVE-2024-13574 XV Random Quotes <= 1.40 - Reflected XSS

The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-23188 Missing Authorization check in SAP S/4HANA (RBD)

An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions beyond their intended permissions. This causes a low impact on integrity with no impact on confidentiality and availability...

CVE-2024-13825

The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-9458

The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13668

The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2025-1363

CVE-2025-1363 affects the WordPress plugin “URL Shortener | Conversion Tracking | AB Testing | WooCommerce” (versions up to 9.0.2). The vulnerability is a Stored Cross-Site Scripting (XSS) that occurs due to insufficient sanitisation/escaping of certain plugin settings, enabling a high-privilege ...

CVE-2024-13825

The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13825

CVE-2024-13825 : The Email Keep WordPress plugin up to version 1.1 is affected by a Reflected XSS vulnerability where a parameter is not sanitized/escaped before being output on the page. This could be exploited against high-privilege users such as admins. The supplied connected sources confirm t...

CVE-2024-13825 Email Keep <= 1.1 - Reflected XSS

The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13668

The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2024-13668

The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2024-13668

The CVE-2024-13668 entry concerns WordPress Activity-o-meter (WordPress plugin) versions

CVE-2024-13668 WordPress Activity O Meter <= 1 - Reflected XSS

The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2024-9458

CVE-2024-9458 concerns the Reservit Hotel WordPress plugin, affected versions prior to 3.0. The root cause is failure to adequately sanitize and escape certain settings, which can permit stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, including multisite...

CVE-2024-9458 Reservit Hotel < 3.0 - Admin+ Stored XSS

The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13868 Easy Broken Link Checker <= 9.0.2 - Reflected XSS

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...