CVE-2024-12626 AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-searchfieldvalue’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitizatio...

CVE-2024-21548

Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. Note: This issue relates to the widely known and actively developed 'Bun'...

CVE-2024-11439

The ScanCircle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'scancircle' shortcode in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12513

CVE-2024-12513 is a Stored XSS in the Contests by Rewards Fuel plugin for WordPress (

CVE-2024-12395

The WooCommerce Additional Fees On Checkout Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-11905 Animated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12474

The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-11883

The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnxscriptcode' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11855

The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-12523

CVE-2024-12523 affects the States Map US WordPress plugin, allowing Stored Cross-Site Scripting via the states_map shortcode in all versions up to 2.4.2. Exploitation requires authenticated access (contributor+) and can inject scripts that run when users visit the page. The provided sources inclu...

CVE-2024-11462 Filestack Official <= 2.1.0 - Reflected Cross-Site Scripting

The Filestack Official plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fstab' and 'filestackoptions' parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2024-11462

CVE-2024-11462 affects the Filestack WP Upload (Filestack Official) WordPress plugin. It enables Reflected XSS via the fstab and filestack_options parameters in all versions up to 2.0.0, exploitable by unauthenticated attackers who lure a user into executing an action. Connected Red Hat entry rep...

CVE-2024-11873

CVE-2024-11873: The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the glomex_integration shortcode in all versions up to and including 0.9.1. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, enabling authentic...

CVE-2024-12465

CVE-2024-12465 (Property Hive Stamp Duty Calculator for WordPress) is a stored XSS flaw in the stamp_duty_calculator_scotland shortcode present in all versions up to 1.0.22. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes, ena...

CVE-2024-12574

The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-12271

The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-28142 Stored cross site scripting

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File Name" page /cgi/uset.cgi?-cfilename in the User Settings menu improperly filters the "file name" and wildcard character input field. By...

CVE-2024-11760

CVE-2024-11760 : The Currency Converter Widget PRO plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) condition via the plugin’s shortcode currency-converter-widget-pro. Affected versions are up to and including 1.0.6 . The underlying issue is insufficient input sanitizatio...

CVE-2024-10583

CVE-2024-10583 : The Popup Maker – Boost Sales, Conversions, Optins, Subscribers (WordPress) is vulnerable to Stored XSS via the post_title parameter in all versions up to 1.20.2 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (Contributor le...

CVE-2024-11871

The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'patreon' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...