CVE-2024-0249

The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2023-2334

The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...

CVE-2024-1663 Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS

The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-9879 Website File Changes < 2.1.1 - Authenticated SQL Injection

The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-9236

CVE-2024-9236 affects the WordPress plugin Team Members Showcase (Team) prior to version 4.4.2. The issue arises because the plugin does not sanitize and escape some settings, enabling Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins), even when the unfiltered_html c...

CVE-2024-8854

The CVE-2024-8854 entry concerns the Polls CP WordPress plugin (versions prior to 1.0.77). The vulnerability arises because the plugin does not sanitize and escape certain poll settings, enabling stored cross-site scripting via admin-level actions, even when unfiltered_html is disallowed (e.g., i...

CVE-2024-8426

The CVE-2024-8426 entry concerns the Page Builder: Pagelayer WordPress plugin before version 1.8.8, where settings are not properly sanitized/escaped. This can allow high-privilege users (e.g., admins) to perform stored Cross-Site Scripting (XSS) attacks even when unfiltered_html is disallowed, a...

CVE-2024-8398

Summary: CVE-2024-8398 affects the WordPress plugin Simple Nav Archives, versions

CVE-2024-8031

The CVE-2024-8031 vulnerability affects the Secure Downloads WordPress plugin (versions before 1.2.3). Root cause: the plugin does not properly restrict which files can be downloaded, enabling authenticated attackers with admin-level access to download arbitrary files (e.g., wp-config.php). Impac...

CVE-2024-7556 Wordpress Simple Share Plugin <=0.5.3 - Admin+ XSS

The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13382 Calculated Fields Form < 5.2.64 - Admin+ Stored XSS

The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12716

The CVE-2024-12716 entry concerns the WordPress plugin Simple Basic Contact Form prior to 20250114. Affected: the plugin’s settings are not properly sanitized/escaped, enabling Stored Cross-Site Scripting (XSS) by high-privilege users (e.g., admins). Impact is possible even when unfiltered_html i...

CVE-2024-12282 WordPress连接微博 <= 2.5.6 - Stored XSS via CSRF

The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-11718 tarteaucitron.js for WordPress < 0.3.0 - Author+ Stored XSS

The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10504

CVE-2024-10504 affects the WordPress plugin Contact Form, Survey, Quiz & Popup Form Builder (ARForms Builder) , specifically versions prior to 1.7.1 . The issue is an improper sanitisation/escaping of certain parameters when they are output on a page, enabling unauthenticated users to perform Cro...

CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin TI WooCommerce Wishlist versions = 2.10.0...

WordPress Responsive Lightbox & Gallery plugin < 2.5.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Responsive Lightbox versions 2.5.1...

WordPress TicketBAI Facturas para WooCommerce plugin <= 3.18 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by CVEhunter in WordPress Plugin TicketBAI Facturas para WooCommerce versions = 3.18...