CVE-2024-12750

The Competition Form WordPress plugin, version 2.0 and earlier , is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when updating settings. This vulnerability allows an attacker to perform unauthorized actions, such as changing settings or deleting competitio...

CVE-2024-12733

The AffiliateImporterEb WordPress plugin (versions 1.0.0 through 1.0.6 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. This vulnerability could be exploited against high-...

CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12733 AffiliateImporterEb <= 1.0.6 - Reflected XSS via Search

The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-11843 Panorama – WordPress Project Management Plugin <= 1.5.1 - Admin+ Stored XSS

The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11718

The tarteaucitron-wp WordPress plugin (versions

CVE-2024-11373 Connexion Logs <= 3.0.2 - Log Deletion via CSRF

The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-11269 AHAthat Plugin <= 1.6 - Admin+ SQL Injection

The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks...

CVE-2024-11190 jwp-a11y <= 4.1.7 - Admin+ Stored XSS

The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10677 BTEV <= 2.0.2 - Settings Update via CSRF

The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10631

The Countdown Timer for WordPress Block Editor WordPress plugin (versions through 1.0.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to validate and escape certain block options before they are outputted in a page or post where the block is embedded. This a...

CVE-2024-10075 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution

The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block...

CVE-2024-10098 ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain...

CVE-2024-10054

The Happyforms WordPress plugin versions prior to 1.26.3 are vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitize and escape certain settings. This allows high-privilege users, such as administrators, to perform XSS attacks, even in environm...

CVE-2024-10054 Happyforms < 1.26.3 - Admin+ Stored XSS

The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-4589

The Bon Toolkit WordPress plugin (versions up to 1.3.2) is vulnerable to Stored Cross-Site Scripting via the bt-map shortcode due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (contributor level or higher) and can inject scripts that execute wh...

PT-2025-21525 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: Page Builder: Pagelayer versions prior to 1.9.0 Description: The issue concerns the Page Builder: Pagelayer WordPress plugin, where versions prior to 1.9.0 do not properly sanitise and escape some of its settings. This could allow...

PT-2025-21390

Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging for WordPress plugin versions prior to 1.8.1 Description: The issue allows unauthenticated users to perform a Stored XSS attack against high-privilege users, such as administrators, due to the plugin's failure t...

PT-2025-21258

Name of the Vulnerable Software and Affected Versions: EG-Series plugin for WordPress versions up to, and including, 2.1.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's series shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-21528 · WordPress · 10Web Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery by 10Web for WordPress versions prior to 1.8.29 Description: The issue allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability ...