CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12743

CVE-2024-12743 affects the MailPoet WordPress plugin (versions before 5.5.2). The root cause is that certain settings are not properly sanitised/escaped, enabling Stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (notably in multisite setups). Exploitation...

CVE-2024-12733 AffiliateImporterEb <= 1.0.6 - Reflected XSS via Search

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12725 Clasify Classified Listing <= 1.0.7 - Reflected XSS

The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12680

CVE-2024-12680 affects the WordPress plugin Prisna GWT (Prisna GWT WordPress plugin) prior to 1.4.14. The issue stems from insufficient sanitisation/escaping of certain settings, enabling stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (such as in multis...

CVE-2024-11190

CVE-2024-11190 covers the jwp-a11y WordPress plugin (versions

CVE-2024-11266

CVE-2024-11266 concerns the Geocache Stat Bar Widget WordPress plugin, up to version 0.911, which does not sufficiently sanitize/escape certain settings. This can let high-privilege users (e.g., admins) perform Stored Cross-Site Scripting even when unfiltered_html is disallowed, particularly in m...

CVE-2024-11189

CVE-2024-11189 affects the Social Share And Social Locker – ARSocial WordPress plugin prior to 1.4.2. The issue is insufficient sanitization/escaping of certain settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Public d...

CVE-2024-11141

The CVE-2024-11141 entry affects the Sailthru Triggermail WordPress plugin (versions 1.1 and earlier). The vulnerability arises because the plugin does not sanitize/escape certain settings and lacks CSRF protection, enabling Stored Cross-Site Scripting attacks even when unfiltered_html is disallo...

CVE-2024-10639 Auto Prune Posts < 3.0.0- Admin+ Stored XSS

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10107 Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10107

CVE-2024-10107 affects the WordPress plugin Giveaways and Contests by RafflePress (versions prior to 1.12.17). The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitisation/escaping of certain plugin settings, allowing high-privilege users (e.g., Admin) to inje...

CVE-2024-10107 Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10098 ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain...

CVE-2024-10098

Summary of CVE-2024-10098 (ApplyOnline – WordPress) : The ApplyOnline WordPress plugin, prior to version 2.6.3, does not protect files uploaded during the application workflow. This allows unauthenticated users to access uploaded files and any private information they contain. Affected software: ...

Exploit for Unrestricted Upload of File with Dangerous Type in Webfulcreations Computer_Repair_Shop

Wordpress Computer Repair Shop = 3.8115 - Unauthenticated Arb...

CVE-2025-4564

CVE-2025-4564 – TicketBAI Facturas para WooCommerce (WordPress) Affected software: TicketBAI Facturas para WooCommerce plugin for WordPress. Root cause: Insufficient file path validation in the delpdf action enables unauthenticated arbitrary file deletion across versions up to 3.18. Impact (as st...

CVE-2025-4339

The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary...

CVE-2025-4317

The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegemgetlogourl function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary...

CVE-2025-3053

The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uipprocessforminput function. This is due to the function taking user supplied inputs to execute arbitrary...