CVE-2024-13331

CVE-2024-13331 affects the WordPress plugin WP Dream Carousel (versions up to 1.0.1b). The issue is a Reflected Cross‑Site Scripting caused by not sanitising and escaping a parameter before it is echoed in the page. The advisory notes this could be exploited against high‑privilege users (e.g., ad...

CVE-2024-13332

CVE-2024-13332 affects the TransFinanz WordPress plugin (versions ≤ 1.0.0). The issue is a Reflected Cross‑Site Scripting caused by inadequate sanitization/escaping of a parameter before output. The vulnerability could be leveraged against high-privilege users (e.g., admins) per Red Hat and CVE‑l...

CVE-2024-13328 Giga Messenger Bots <= 2.3.1 - Reflected XSS

The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13329

The CVE-2024-13329 entry concerns the Solidres WordPress plugin (versions up to 0.9.4). Description confirms a Reflected XSS vulnerability caused by insufficient sanitization/escaping of a parameter before it is echoed in the page, potentially impacting high-privilege users (e.g., admins). Connec...

CVE-2024-13329 Solidres <= 0.9.4 - Reflected XSS

The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13328 Giga Messenger Bots <= 2.3.1 - Reflected XSS

The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13330 Justrows Free <= 0.2 - Reflected XSS

The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13329 Solidres <= 0.9.4 - Reflected XSS

The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13330

The CVE-2024-13330 entry concerns the JustRows free WordPress plugin (versions up to 0.2). The flaw is a Reflected XSS caused by not sanitising/escaping a parameter before echoing it in the page, enabling an attacker to craft input that could be reflected back to high-privilege users (e.g., admin...

CVE-2024-13328

CVE-2024-13328 affects the WordPress plugin “Giga Messenger – Express” (Giga Messenger) up to version 2.3.1. The connected documents confirm a vulnerability where a parameter is not sanitised or escaped before being echoed back on the page, resulting in a Reflected Cross-Site Scripting (XSS) vuln...

CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS

The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13327 Musicbox <= 2.0.3 - Reflected XSS

The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13327

The CVE covers the Musicbox WordPress plugin (versions 2.0.3 and earlier). A Reflected XSS occurs due to lack of sanitization and escaping of a parameter before it’s output on the page, enabling script execution in the context of high-privilege users (e.g., admins). The Nuclei template confirms t...

CVE-2024-13326

CVE-2024-13326 affects the iBuildApp WordPress plugin (versions up to 0.2.0). The issue is a reflected cross-site scripting (XSS) caused by insufficient sanitization/escaping of a parameter before echoing it to the page, enabling an attacker to trick high-privilege users (e.g., admins) into execu...

CVE-2024-13327 Musicbox <= 2.0.3 - Reflected XSS

The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS

The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13325 Glossy <= 2.3.5 - Reflected XSS

The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13114 WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS

The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13114

CVE-2024-13114 relates to the WordPress plugin “WP Projects Portfolio with Client Testimonials” (versions

PT-2025-2118 · WordPress · Transfinanz Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: TransFinanz WordPress plugin version 1.0.0 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...