CVE-2024-6478

The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite se...

CVE-2024-5440

The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2024-12679

The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-0852

The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin...

CVE-2024-0249

The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2023-2334

The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...

CVE-2024-1663 Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS

The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-9879 Website File Changes < 2.1.1 - Authenticated SQL Injection

The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-9236

The Team WordPress plugin (also referred to as Team Members Showcase ) is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 4.4.2 . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrato...

CVE-2024-8854

The Polls CP WordPress plugin (versions prior to 1.0.77 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitise and escape certain poll settings. This flaw allows high-privilege users, such as administrators, to execute malicious scripts, even in environments wh...

CVE-2024-8426

The Page Builder: Pagelayer WordPress plugin versions prior to 1.8.8 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as administrators, to perform XSS attacks even w...

CVE-2024-8398

The Simple Nav Archives WordPress plugin, versions 2.1.3 and earlier , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings. An attacker could trick a logged-in administrator into making unauthorized changes to these se...

CVE-2024-8031

The Secure Downloads WordPress plugin versions prior to 1.2.3 is vulnerable to an arbitrary file download flaw. The root cause is the plugin's failure to properly restrict which files can be downloaded by authenticated users. This allows attackers with admin-level access and above to retrieve arb...

CVE-2024-7556 Wordpress Simple Share Plugin <=0.5.3 - Admin+ XSS

The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13382 Calculated Fields Form < 5.2.64 - Admin+ Stored XSS

The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12716

The Simple Basic Contact Form WordPress plugin (versions prior to 20250114 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS at...

CVE-2024-12282 WordPress连接微博 <= 2.5.6 - Stored XSS via CSRF

The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-11718 tarteaucitron.js for WordPress < 0.3.0 - Author+ Stored XSS

The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10504

The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin, in versions prior to 1.7.1 , is vulnerable to an unauthenticated Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain parameters when they are outputted on a page. This...