CVE-2024-5807

The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations...

CVE-2024-5807

The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations...

CVE-2024-6226

CVE-2024-6226 relates to the WpStickyBar WordPress plugin (versions up to 2.1.0). It describes a reflected XSS flaw where a user-supplied parameter is not properly sanitized/escaped before being echoed on a page. The impact is described as allowing an attacker to target high-privilege users (e.g....

CVE-2024-6536 Zephyr Project Manager < 3.3.99 - Editor+ XSS

The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-6223 Send email only on Reply to My Comment <= 1.0.6 - Reflected XSS

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6223

CVE-2024-6223 corresponds to a Reflected XSS in the WordPress plugin Send email only on Reply to My Comment, affecting versions up to 1.0.6. The issue arises from insufficient sanitisation/escaping of a parameter before output, enabling an attacker to inject script that could execute in a privile...

CVE-2024-4096

CVE-2024-4096 affects the WordPress plugin Responsive Tabs (versions up to 4.0.8). The vulnerability is aStored Cross-Site Scripting (XSS) caused by insufficient sanitization/escaping of certain Tab settings, potentially enabling a high-privilege user (Contributor+) to inject scripts. Public deta...

CVE-2024-4096 Responsive Tabs <= 4.0.8 - Contributor+ Stored XSS

The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks...

PT-2024-37463 · WordPress · Send Email Only On Reply To My Comment

Name of the Vulnerable Software and Affected Versions: Send email only on Reply to My Comment WordPress plugin versions 1.0.0 through 1.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before bei...

PT-2024-27129 · WordPress · Web Directory Free Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Web Directory Free WordPress plugin versions prior to 1.7.2 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in...

PT-2024-29175 · WordPress · Responsive Tabs

Name of the Vulnerable Software and Affected Versions: Responsive Tabs WordPress plugin versions 4.0.8 and earlier Description: The issue allows high privilege users, such as Contributors and above, to perform Stored Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some ...

CVE-2024-5883

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5883

CVE-2024-5883 affects the Ultimate Classified Listings WordPress plugin (versions before 1.3). The issue is a reflected cross-site scripting (XSS) vulnerability where a parameter is not properly sanitised/escaped before being echoed back in the page, enabling an attacker to execute script in admi...

CVE-2024-5883 Ultimate Classified Listings < 1.3 - Reflected XSS

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-29565 · Byond +1 · Byond +1

Name of the Vulnerable Software and Affected Versions: tgstation-server versions prior to 6.8.0 Description: The issue allows low permission users with the "Set .dme Path" privilege to potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files...

PT-2024-37380 · WordPress · Wp Ulike

Name of the Vulnerable Software and Affected Versions: WP ULike WordPress plugin versions prior to 4.7.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

CVE-2024-4260

CVE-2024-4260 concerns the WordPress plugin Page Builder Gutenberg Blocks (CoBlocks) , prior to version 3.1.12. The issue arises from the plugin not restricting pinging to arbitrary hosts via some of its shortcodes, potentially enabling a high-privilege user (e.g., a Contributor) to perform an SS...

CVE-2024-4260 CoBlocks < 3.1.12 - Contributor+ SSRF

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks...

PT-2024-30054 · WordPress · Page Builder Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: The Page Builder Gutenberg Blocks WordPress plugin versions prior to 3.1.12 Description: The issue allows high privilege users, such as contributors, to perform Server-Side Request Forgery SSRF attacks by pinging arbitrary hosts via some of i...

CVE-2024-5004

The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...