CVE-2024-12204

CVE-2024-12204 (Coupon X: Discount Pop Up, etc.) is a WordPress plugin vulnerability where missing capability checks in class-cx-rest.php allowed authenticated users with Subscriber+ access to perform privileged actions: create 100% off coupons, delete posts and leads, and update coupon statuses....

CVE-2024-13183

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titletag’ parameter in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-0311 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin Email Reminders cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Email Reminders version 2.0.5 and previous versions of cross-site scripting vulnerabili...

CVE-2025-22510 WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Konrad Karpieszuk WC Price History for Omnibus allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through 2.1.4...

CVE-2025-22510

CVE-2025-22510 describes a Deserialization of Untrusted Data vulnerability in the WC Price History for Omnibus WordPress plugin (WC Price History) that allows Object Injection. Affected: WC Price History for Omnibus versions up to 2.1.4 (hosted on WordPress). Root cause: untrusted data deserializ...

CVE-2025-22802 WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop...

CVE-2025-22805 WordPress Skill Bar Plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themepoints Skill Bar skillbars allows Stored XSS.This issue affects Skill Bar: from n/a through = 1.2...

CVE-2025-22819 WordPress Qr Code and Barcode Scanner Reader plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Roberto Bottalico Qr Code and Barcode Scanner Reader qr-code-and-barcode-scanner-reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through = 1.0.0...

CVE-2024-12848

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to uploa...

CVE-2024-12514

The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12394

The Action Network plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-12542

The CVE concerns the WordPress linkID plugin (versions up to and including 0.1.2). The root cause is a missing capability check when the PHP function phpinfo is included, which allows unauthenticated attackers to read configuration settings and predefined variables on the site’s server without ac...

CVE-2024-12514

CVE-2024-12514 refers to the WordPress plugin 3D Viewer Online : a stored cross-site scripting flaw in the plugin’s '3Dvo-model' shortcode affecting all versions up to and including 2.2.2 . The vulnerability enables authenticated attackers with contributor-level access or higher to inject scripts...

CVE-2024-12819

CVE-2024-12819 affects the WordPress Searchie plugin up to version 1.17.0. The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin shortcode sio_embed_media, caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers ...

CVE-2024-11815

CVE-2024-11815 targets Pósturinn's Shipping with WooCommerce (WordPress). The Red Hat advisory and Wordfence entry confirm a Reflected XSS vulnerability in the plugin, exploitable by unauthenticated attackers via the printed_marked and nonprinted_marked parameters. The flaw arises from insufficie...

CVE-2024-5769

CVE-2024-5769 (MIMO Woocommerce Order Tracking, WordPress) The vulnerability stems from a missing capability check in multiple functions across all versions up to 1.0.2, allowing authenticated attackers with Subscriber-level access and above to add, update, or delete shipper tracking settings (da...

CVE-2024-12249 GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection

The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12496

CVE-2024-12496 involves the WordPress Linear plugin (versions

CVE-2024-12618 Newsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset

The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in all versions up to, and including, 4.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...