CVE-2024-11760

CVE-2024-11760 : The Currency Converter Widget PRO plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) condition via the plugin’s shortcode currency-converter-widget-pro. Affected versions are up to and including 1.0.6 . The underlying issue is insufficient input sanitizatio...

CVE-2024-10583

CVE-2024-10583 : The Popup Maker – Boost Sales, Conversions, Optins, Subscribers (WordPress) is vulnerable to Stored XSS via the post_title parameter in all versions up to 1.20.2 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (Contributor le...

CVE-2024-11871

The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'patreon' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11766

The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gsbookshowcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output...

CVE-2024-11410 Top and footer bars for announcements, notifications, advertisements, promotions – YooBar <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This mak...

CVE-2024-12338

The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolboxusername’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2024-12260

The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-12461 WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP-Revive Adserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpreviveasync' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11413 HostFact bestelformulier integratie <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The HostFact bestelformulier integratie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bestelformulier' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-53273 GHSL-2024-110: Reflected XSS in /register in habitica

Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The register function in RegisterLoginReset.vue contains a reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious...

CVE-2024-11928

CVE-2024-11928 (iChart – Easy Charts and Graphs, WordPress) is a stored XSS in the WP plugin that affects all versions up to 2.1.0, exploitable via the width parameter. The vulnerability arises from insufficient input sanitization and output escaping, allowing an authenticated attacker with Contr...

CVE-2024-11940

CVE-2024-11940 relates to the Property Hive Mortgage Calculator plugin for WordPress. The flaw is a Stored Cross-Site Scripting (XSS) via the price parameter in all versions up to 1.0.6. Authenticated users with Contributor+ access can inject scripts that execute when pages are loaded by other us...

CVE-2024-11464

The Easy Code Snippets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-12166

The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2024-12165 Mollie for Contact Form 7 <= 5.0.0 - Reflected Cross-Site Scripting

The Mollie for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-4633 Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting

The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addExtraMimeType’ function in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-9866

The Event Tickets with Ticket Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping and missing authorization on the functionality to manage tickets...

CVE-2024-11204

The CVE refers to WordPress plugin ForumWP (Forum & Discussion Board) with a Reflected Cross-Site Scripting vulnerability via the url parameter in all versions up to and including 2.1.2. Public details confirm the issue stems from insufficient input sanitization and output escaping, enabling unau...

CVE-2024-11352

The CVE-2024-11352 entry concerns the TwentyTwenty WordPress plugin. It describes a Stored Cross-Site Scripting (XSS) vulnerability in the plugin’s twentytwenty shortcode, affecting all versions up to 1.0.1. exploitation requires authenticated access at contributor level or higher, enabling an at...

CVE-2024-10320 Cookielay <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode

The Cookielay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookielay shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...