CVE-2024-12874

The CVE-2024-12874 entry concerns the WordPress plugin Top Comments, affected up to version 1.0. The issue is caused by insufficient sanitization/escaping of certain settings, enabling Stored XSS by high-privilege admins (e.g., in multisite) even when unfiltered_html is disallowed. Public exploit...

CVE-2024-12750 Competition Form <= 2.0 - Competition Deletion via CSRF

The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-12750

CVE-2024-12750 concerns the WordPress plugin Competition Form (versions

CVE-2024-12750 Competition Form <= 2.0 - Competition Deletion via CSRF

The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-12679 Prisna GWT < 1.4.14 - Admin+ Stored XSS

The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12716

The CVE-2024-12716 entry concerns the WordPress plugin Simple Basic Contact Form prior to 20250114. Affected: the plugin’s settings are not properly sanitized/escaped, enabling Stored Cross-Site Scripting (XSS) by high-privilege users (e.g., admins). Impact is possible even when unfiltered_html i...

CVE-2024-11373

The Connexion Logs WordPress plugin (versions

CVE-2024-11373 Connexion Logs <= 3.0.2 - Log Deletion via CSRF

The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-11221

The CVE-2024-11221 entry concerns the WordPress plugin Full Screen (Page) Background Image Slideshow, version

CVE-2024-11221 Full Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSS

The Full Screen Page Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10677 BTEV <= 2.0.2 - Settings Update via CSRF

The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10677

CVE-2024-10677 affects the BTEV WordPress plugin up to version 2.0.2. The vulnerability is a lack of CSRF protection when updating plugin settings, which could let an attacker, in a CSRF context, cause a logged-in administrator to change settings. The CVE description and entries from NVD/Red Hat ...

CVE-2024-10634

The CVE-2024-10634 entry concerns the Nokaut Offers Box WordPress plugin (versions ≤ 1.4.0). Affected component: plugin settings update logic lacking CSRF protection, enabling a CSRF attack that could cause a logged-in administrator to reset the plugin. Exploitation details are not provided beyon...

CVE-2024-10677 BTEV <= 2.0.2 - Settings Update via CSRF

The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed f...

CVE-2024-10362 Social Media Share Buttons < 2.9.0 - Admin+ Stored XSS

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

CVE-2024-10149 Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets

The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10362

CVE-2024-10362 affects the WordPress plugin Social Media Share Buttons & Social Sharing Icons (versions before 2.9.1). The issue is improper sanitization/escaping of certain plugin settings, potentially allowing stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disall...

CVE-2024-10107 Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10143

CVE-2024-10143 affects the MB Custom Post Types & Custom Taxonomies WordPress plugin, prior to version 2.7.7. The issue arises from inadequate sanitisation/escapes of certain settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins) even when unfiltered_html is disallo...