CVE-2024-12731 aklamator-infeed <= 2.0.0 - Reflected XSS

The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12715 Asgard Security Scanner <= 0.7 - Reflected XSS

The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12715

The CVE-2024-12715 entry concerns the Asgard Security Scanner WordPress plugin (versions up to 0.7) and is supported by connected RH records and index references that describe a Reflected Cross-Site Scripting vulnerability. The vulnerability arises from insufficient sanitization/escaping of a par...

CVE-2024-12714 Backlink Monitoring Manager <= 0.1.3 - Reflected XSS

The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-1937 · WordPress · Asgard Security Scanner

Name of the Vulnerable Software and Affected Versions: Asgard Security Scanner WordPress plugin versions 0.7 and earlier Description: The issue arises from the plugin not sanitizing and escaping a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. This...

PT-2025-1936 · WordPress · Backlink Monitoring Manager

Name of the Vulnerable Software and Affected Versions: Backlink Monitoring Manager WordPress plugin versions 0.1.3 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the...

CVE-2024-12585

The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12585

CVE-2024-12585 affects the Property Hive WordPress plugin (vulnerable through 2.1.1). The issue is a Reflected XSS: a parameter is output back to the page without proper sanitisation/escaping, enabling an attacker to craft input that could affect high-privilege users (e.g., admins). The Red Hat a...

CVE-2024-12585 PropertyHive < 2.1.1 - Reflected XSS

The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12585 PropertyHive < 2.1.1 - Reflected XSS

The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-8857

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

CVE-2024-9638

The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8857

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

CVE-2024-10562

The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10102

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-10102

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-8857

CVE-2024-8857 affects WordPress Auction Plugin (WordPress Auction Plugin) up to version 3.7. The issue is Stored Cross-Site Scripting (XSS) via unsanitized/unchecked plugin settings, allowing an Editor+ (high-privilege) user to inject scripts. Multiple connected sources corroborate the vulnerabil...

CVE-2024-8857 WordPress Auction <= 3.7 - Editor+ Stored XSS

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

CVE-2024-8857 WordPress Auction <= 3.7 - Editor+ Stored XSS

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

PT-2025-1594 · 10Web · The Form Maker

Name of the Vulnerable Software and Affected Versions: The Form Maker by 10Web WordPress plugin versions prior to 1.15.31 Description: The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, for...