WordPress Team Members Showcase plugin < 4.4.2 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Team versions 4.4.2...

WordPress Wordpress Clicksold IDX Plugin plugin <= 1.90 - Admin+ XSS vulnerability

Admin+ XSS vulnerability discovered by Amandeep Singh Banga in WordPress Plugin Clicksold IDX versions = 1.90...

WordPress PWA For WP & AMP plugin < 1.7.72 Administrator+ Stored XSS vulnerability

WordPress PWA For WP & AMP plugin 1.7.72 Administrator+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin PWA for WP & AMP versions 1.7.72...

WordPress DL Verification plugin <= 1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin DL Verification versions = 1.2...

WordPress CTT Expresso para WooCommerce plugin < 3.2.13 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin CTT Expresso para WooCommerce versions 3.2.13...

WordPress DL Yandex Metrika plugin <= 1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin DL Yandex Metrika versions = 1.2...

WordPress Responsive Gallery Grid plugin < 2.3.15 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Responsive Gallery Grid versions 2.3.15...

WordPress Advanced Cron Manager plugin < 2.5.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Advanced Cron Manager – debug & control versions 2.5.7...

WordPress Post Grid, Post Carousel, & List Category Posts plugin < 2.4.28 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 2.4.28...

WordPress Competition Form plugin <= 2.0 - Competition Deletion via CSRF vulnerability

Competition Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Competition Form versions = 2.0...

WordPress Advance Post Prefix plugin <= 1.1.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Advance Post Prefix versions = 1.1.1...

WordPress plugin Hospital Management System 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

WordPress AffiliateImporterEb plugin <= 1.0.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin AffiliateImporterEb versions = 1.0.6...

WordPress WP DeskLite plugin <= 1.0.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WP DeskLite versions = 1.0.0...

WordPress Panorama – WordPress Project Management Plugin plugin <= 1.5.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Panorama – WordPress Project Management Plugin versions = 1.5.1...

WordPress tarteaucitron.js for WordPress plugin < 0.3.0 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin tarteaucitron.js for WordPress versions 0.3.0...

CVE-2025-0687

The Spiritual Gifts Survey and optional S.H.A.P.E survey WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-12800

The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12735

The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above to perform SQL injection attacks...

CVE-2024-12724

The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...