CVE-2024-10152

CVE-2024-10152 affects the WordPress plugin Simple Certain Time to Show Content (versions before 1.3.1). The vulnerability is a Reflected XSS caused by insufficient sanitization/escaping of an input parameter before it is echoed in the page, potentially impacting high-privilege users (e.g., admin...

CVE-2024-10152 Simple Certain Time to Show Content < 1.3.1 - Reflected XSS

The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-8678 · WordPress · Om Stripe Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Om Stripe WordPress plugin versions through 02.00.00 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

PT-2025-8682 · WordPress · Calendapp

Name of the Vulnerable Software and Affected Versions: CalendApp WordPress plugin versions 1.1 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

PT-2025-8679 · WordPress · Wp Extra Fields

Name of the Vulnerable Software and Affected Versions: WP Extra Fields WordPress plugin version 1.0.1 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...

PT-2025-8681 · WordPress · Sync Posts

Name of the Vulnerable Software and Affected Versions: Post Sync WordPress plugin version 1.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

PT-2025-8677

Name of the Vulnerable Software and Affected Versions NewsTicker WordPress plugin version 1.0 Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be exploited...

TikTok: Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard Activities

A broken access control vulnerability in TikTok Live Backstage allowed low-privilege users to gain unauthorized control over public leaderboard activities belonging to other organizations...

CVE-2024-10545

The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10545

CVE-2024-10545 affects the WordPress plugin NextGEN Gallery (before 3.59.9). The issue is insufficient sanitization/escaping of image settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., Admin) even when unfiltered_html is disallowed (such as in multisite). Affected softw...

CVE-2024-13822

The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13605

The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13822

The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13822 Total Contest Lite <= 2.8.1 - Reflected XSS

The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13822

The CVE-2024-13822 entry concerns the WordPress plugin Total Contest Lite (Photo Contest | Competition | Video Contest) up to version 2.8.1, which outputs an unsanitized parameter, enabling a Reflected XSS. Connected sources corroborate a reflected-XSS issue in Total Contest Lite (versions ≤ 2.8....

CVE-2024-13822 Total Contest Lite <= 2.8.1 - Reflected XSS

The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13605

The CVE-2024-13605 entry concerns Form Maker by 10Web for WordPress, affecting versions prior to 1.15.33. It is a Stored XSS in certain settings due to insufficient sanitisation/escaping, which can be triggered by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., ...

PT-2025-7704 · WordPress · The Photo Contest | Competition | Video Contest

Name of the Vulnerable Software and Affected Versions: The Photo Contest | Competition | Video Contest WordPress plugin versions 2.8.1 and earlier Description: The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin. This occurs becau...

CVE-2024-13314

The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

GHSA-C39W-3PJX-QC7M Leantime allows Stored Cross-Site Scripting (XSS)

Description Leantime allows stored cross-site scripting XSS in the API key name while generating the API key. Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading t...