CVE-2024-10869

The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for...

CVE-2024-10880

The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated...

PT-2024-16943

Name of the Vulnerable Software and Affected Versions The Theater for WordPress plugin versions up to, and including, 0.18.6.2 Description The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site Scripting. This allows unauthenticated...

PT-2024-39205

Name of the Vulnerable Software and Affected Versions: MailChimp Forms by MailMunch plugin for WordPress versions up to, and including, 3.2.3 Description: The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without...

PT-2024-16617

Name of the Vulnerable Software and Affected Versions SimpleForm – Contact form made simple plugin for WordPress versions up to, and including, 2.2.0 Description The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without proper escaping on...

CVE-2024-10683

The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.3.1. This makes it possible for unauthenticated attackers...

PT-2024-39160 · WordPress · Koko Analytics

Name of the Vulnerable Software and Affected Versions: Koko Analytics plugin for WordPress versions prior to 1.3.13 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts in pages. This can...

CVE-2024-8797

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers...

CVE-2024-8665

The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

PT-2024-39162 · WordPress · Wp Test Email

Name of the Vulnerable Software and Affected Versions: WP Test Email plugin for WordPress versions up to, and including, 1.1.7 Description: The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the UR...