CVE-2024-13220

The CVE-2024-13220 entry describes a Reflected Cross-Site Scripting in the WordPress Google Map Professional (Map In Your Language) plugin (versions <= 1.0) where an input parameter is not sanitized/escaped before being echoed on the page. This could allow an attacker to inject script against ...

CVE-2024-13219 Policy Genius <= 2.0.4 - Reflected XSS

The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional Map In Your Language WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13218 Fast Tube <= 2.3.1 - Reflected XSS

The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13218

CVE-2024-13218 - Fast Tube WordPress plugin : The Fast Tube WordPress plugin (versions up to 2.3.1) is vulnerable to a Reflected Cross-Site Scripting (XSS) due to improper sanitization/escaping of a parameter before it is output on the page. This could allow an attacker to target high-privilege u...

CVE-2024-13219

CVE-2024-13219 is a Reflected XSS in the Privacy Policy Genius WordPress plugin up to version 2.0.4, caused by insufficient sanitisation/escaping of a parameter before output. The issue could impact high-privilege users (e.g., admins) when the vulnerable plugin is active. Publicly available detai...

CVE-2024-13112 WP MediaTagger <= 4.1.1 - Reflected XSS

The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13112 WP MediaTagger <= 4.1.1 - Reflected XSS

The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13112

WP MediaTagger WordPress plugin vulnerability CVE-2024-13112: Reflected XSS in 4.1.1 and earlier where a parameter is not sanitized/escaped before echoing in the page. Could affect admin/high-privilege users. Connected documents confirm the issue but do not publicly specify a patch/version beyond...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12872 Zalomení <= 1.5 - Admin+ Stored XSS

The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12872 Zalomení <= 1.5 - Admin+ Stored XSS

The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12275 CanvasFlow <= 1.5.5 - Reflected XSS

The Canvasflow for WordPress plugin through 1.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12275

CVE-2024-12275 affects the CanvasFlow for WordPress plugin (versions up to 1.5.5). The issue is a Reflected XSS caused by not sanitising/escaping a parameter before echoing it in the page, potentially impacting high-privilege users such as admins. The connected documents confirm the vulnerability...

PT-2025-2010

Name of the Vulnerable Software and Affected Versions WP MediaTagger WordPress plugin versions 4.1.1 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This coul...

PT-2025-1973 · WordPress · Zalomení Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Zalomení WordPress plugin versions 1.5 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2025-2074

Name of the Vulnerable Software and Affected Versions The WordPress Google Map Professional Map In Your Language WordPress plugin versions 1.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before...

PT-2025-1799 · WordPress · Canvasflow

Name of the Vulnerable Software and Affected Versions: Canvasflow for WordPress plugin versions 1.5.5 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2025-2078

Name of the Vulnerable Software and Affected Versions SlideDeck 1 Lite Content Slider plugin versions 1.4.8 and earlier Description The issue arises from the plugin not sanitizing and escaping a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting that...