CVE-2024-9182 Maspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSS

The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-8702 Backup Database <= 4.9 - Admin+ Stored XSS

The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8701 Event Calendar <= 1.0.4 - Admin+ Stored XSS

The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8620 MapPress Maps for WordPress < 2.93 - Admin+ Stored XSS via Map Settings

The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8699

The Z-Downloads WordPress plugin (versions prior to 1.11.5 ) is vulnerable to an arbitrary file upload vulnerability due to a failure in properly validating uploaded files. This flaw allows high-privilege users, such as administrators, to upload files to the server even when restricted, such as i...

CVE-2024-8618 Page Builder: Pagelayer < 1.9.0- Admin+ Stored XSS

The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8617 Quiz Maker <= 6.5.9.8 - Admin+ Stored XSS

The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8618 Page Builder: Pagelayer < 1.9.0- Admin+ Stored XSS

The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8397

The webtoffee-gdpr-cookie-consent WordPress plugin (versions prior to 2.6.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper sanitization and escaping of IP headers during the logging process. An unauthenticated visitor can submit a malicious payload that exec...

CVE-2024-8245

The GamiPress WordPress plugin (versions prior to 1.0.1 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of proper CSRF checks when updating plugin settings. An attacker could trick a logged-in administrator into performing actions that modify the plugin's configuration...

CVE-2024-8094

The CVE-2024-8094 entry identifies a CSRF flaw in the Ntz Antispam WordPress plugin (versions up to 2.0e) where the settings update flow lacks CSRF protection. Root cause: missing CSRF check when updating plugin settings. Impact: a CSRF attack could cause a logged-in admin to change settings. Pub...

CVE-2024-7769 Wordpress Clicksold IDX Plugin <= 1.90 - Admin+ XSS

The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6719 Offload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRF

The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack...

CVE-2024-6665

The KBucket: Your Curated Content WordPress plugin versions prior to 4.1.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS at...

CVE-2024-5440 If-So Dynamic Content Personalization < 1.8.0.3 - Contributor+ Shortcode Stored XSS

The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2024-13727

The MemberSpace WordPress plugin prior to version 2.1.14 is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is the failure to sanitize and escape a parameter before outputting it back to the page. This vulnerability impacts unauthenticated users , allowing an attacker ...

CVE-2024-13616

The VikBooking Hotel Booking Engine & PMS WordPress plugin, in versions prior to 1.7.2 , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitize and escape certain settings. This vulnerability allows high-privilege users, such as administrat...

CVE-2024-13357

The Ditty WordPress plugin versions prior to 3.1.52 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This vulnerability allows high-privilege users, such as those with Author permissions, to execute stored ...

CVE-2024-13128

The LearnPress WordPress plugin (versions prior to 4.2.7.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization and escaping of certain settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks even in environments where the...

CVE-2024-13128 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...