Vendor CVEs

WordPress

All CVEs

40,071 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-11360	WordPress Page Parts	Med	0.33	6.1	0.01	Nov 21, 2024	The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitrary…
CVE-2024-10890	WordPress Wpadverts	Med	0.33	6.1	0.01	Nov 21, 2024	The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for…
CVE-2024-10792	WordPress Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels	Med	0.33	6.1	0.01	Nov 21, 2024	The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes…
CVE-2024-10726	WordPress Friendly Functions For Welcart	Med	0.33	6.1	0.00	Nov 21, 2024	The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to…
CVE-2024-10682	WordPress Announcement & Notification Banner – Bulletin	Med	0.33	6.1	0.01	Nov 21, 2024	The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg and remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.11.7. This makes it…
CVE-2024-10522	WordPress Co Marquage Service Public	Med	0.33	6.1	0.01	Nov 21, 2024	The Co-marquage service-public.fr plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.5.76. This makes it possible for unauthenticated attackers to…
CVE-2024-11278	WordPress Gd Bbpress Attachments	Med	0.33	6.1	0.00	Nov 20, 2024	The GD bbPress Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.7.2. This makes it possible for unauthenticated attackers to inject…
CVE-2024-10103	WordPress MailPoet	Med	0.33	6.1	0.00	Nov 19, 2024	In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
CVE-2024-8873	WordPress PeproDev WooCommerce Receipt Uploader	Med	0.33	6.1	0.00	Nov 16, 2024	The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated…
CVE-2024-10825	WordPress Hide My Wp Ghost	Med	0.33	6.1	0.00	Nov 15, 2024	The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
CVE-2024-9609	Thimpress Learnpress Export Import	Med	0.33	6.1	0.00	Nov 15, 2024	The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and…
CVE-2024-10877	WordPress The AFI – The Easiest Integration Plugin	Med	0.33	6.1	0.01	Nov 13, 2024	The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.92.0. This makes it possible for…
CVE-2024-10684	Kognetiks Chatbot	Med	0.33	6.1	0.00	Nov 13, 2024	The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
CVE-2024-10851	Razorpay Razorpay Payment Button	Med	0.33	6.1	0.01	Nov 13, 2024	The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for…
CVE-2024-10850	Razorpay Razorpay Payment Button	Med	0.33	6.1	0.01	Nov 13, 2024	The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for…
CVE-2024-10265	WordPress Form Maker by 10Web	Med	0.33	6.1	0.00	Nov 10, 2024	The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it…
CVE-2024-10837	WordPress Customize My Account For Woocommerce	Med	0.33	6.1	0.00	Nov 9, 2024	The SysBasics Customize My Account for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 2.7.29 due to insufficient input sanitization and output escaping. This makes it possible for…
CVE-2024-10876	WordPress Charitable	Med	0.33	6.1	0.00	Nov 9, 2024	The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to,…
CVE-2024-10647	WordPress WS Form LITE	Med	0.33	6.1	0.00	Nov 6, 2024	The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it…
CVE-2024-9667	WordPress Seriously Simple Podcasting	Med	0.33	6.1	0.00	Nov 5, 2024	The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.0. This makes it possible for unauthenticated attackers to…
CVE-2024-9896	WordPress Bbp Core	Med	0.33	6.1	0.00	Nov 2, 2024	The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible…
CVE-2024-8739	WordPress ReCaptcha Integration for WordPress	Med	0.33	6.1	0.00	Nov 2, 2024	The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers…
CVE-2024-9438	WordPress SEUR Oficial	Med	0.33	6.1	0.00	Oct 29, 2024	The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
CVE-2024-10048	WordPress Post Status Notifier Lite	Med	0.33	6.1	0.00	Oct 29, 2024	The Post Status Notifier Lite and Premium plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.11.6 due to insufficient input sanitization and output escaping. This makes it possible for…
CVE-2024-8870	WordPress Forms for Mailchimp by Optin Cat	Med	0.33	6.1	0.01	Oct 26, 2024	The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for…
CVE-2024-9613	Formfacade Formfacade	Med	0.33	6.1	0.00	Oct 26, 2024	The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This…
CVE-2024-9214	WordPress Extra Product Options Builder for WooCommerce	Med	0.33	6.1	0.00	Oct 24, 2024	The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'RednaoSerializedFields' parameter during the creation of a signature file in all versions up to, and including, 1.2.133 due to insufficient input…
CVE-2024-8717	WordPress DearFlip	Med	0.33	6.1	0.00	Oct 24, 2024	The PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pdf_source' parameter in all versions up to, and including, 2.3.32 due to insufficient input sanitization and output escaping. This…
CVE-2024-9865	WordPress Eventprime	Med	0.33	6.1	0.00	Oct 24, 2024	The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping.…
CVE-2024-9864	WordPress Eventprime	Med	0.33	6.1	0.00	Oct 24, 2024	The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for…
CVE-2024-9231	WordPress WP-Members Membership Plugin	Med	0.33	6.1	0.00	Oct 22, 2024	The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.9.5. This makes it possible for unauthenticated attackers to…
CVE-2024-9219	Maxfoundry Social Share Buttons	Med	0.33	6.1	0.00	Oct 19, 2024	The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.19. This makes it possible for unauthenticated attackers to…
CVE-2024-9206	MAS Companies MAS Companies For WP Job Manager	Med	0.33	6.1	0.00	Oct 18, 2024	The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to…
CVE-2024-9383	WordPress Parcel Pro	Med	0.33	6.1	0.00	Oct 18, 2024	The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
CVE-2024-9213	WordPress Persian Woocommerce Sms	Med	0.33	6.1	0.00	Oct 17, 2024	The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible…
CVE-2024-9347	WordPress The Ultimate WordPress Toolkit – WP Extended	Med	0.33	6.1	0.00	Oct 17, 2024	The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible…
CVE-2024-9240	WordPress Redi Restaurant Reservation	Med	0.33	6.1	0.00	Oct 17, 2024	The ReDi Restaurant Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 24.0902. This makes it possible for unauthenticated attackers to…
CVE-2020-36831	WordPress NextScripts: Social Networks Auto-Poster	Med	0.33	5.0	0.01	Oct 16, 2024	The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged…
CVE-2024-9647	Kama SpamBlock Kama SpamBlock	Med	0.33	6.1	0.00	Oct 16, 2024	The Kama SpamBlock plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST values in all versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
CVE-2024-8787	WordPress Smart Online Order For Clover	Med	0.33	6.1	0.00	Oct 16, 2024	The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.7. This makes it possible for…
CVE-2024-9610	WordPress Language Switcher	Med	0.33	6.1	0.00	Oct 11, 2024	The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.7.13. This makes it possible for unauthenticated attackers to inject…
CVE-2024-9436	WordPress Publishpress Revisions	Med	0.33	6.1	0.00	Oct 11, 2024	The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14.…
CVE-2024-9232	WordPress Download Plugins Dashboard	Med	0.33	6.1	0.00	Oct 11, 2024	The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for…
CVE-2024-9221	Tainacan Tainacan	Med	0.33	6.1	0.00	Oct 11, 2024	The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.21.10. This makes it possible for unauthenticated attackers to inject arbitrary web…
CVE-2024-9377	WordPress Order Import Export For Woocommerce	Med	0.33	6.1	0.00	Oct 10, 2024	The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it…
CVE-2024-9207	WordPress Buddypress Docs	Med	0.33	6.1	0.00	Oct 8, 2024	The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to inject…
CVE-2024-8629	WordPress WooCommerce Multilingual & Multicurrency with WPML	Med	0.33	6.1	0.00	Oct 8, 2024	The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for…
CVE-2024-44010	Catchthemes Full Frame	Med	0.33	5.1	0.00	Oct 6, 2024	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Full frame full-frame allows Stored XSS.This issue affects Full frame: from n/a through <= 2.7.2.
CVE-2024-47313	Catchthemes Catch Base	Med	0.33	5.1	0.00	Oct 6, 2024	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Catch Base catch-base allows Stored XSS.This issue affects Catch Base: from n/a through <= 3.4.6.
CVE-2024-47356	Catchthemes Create	Med	0.33	5.1	0.00	Oct 6, 2024	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Create create allows Stored XSS.This issue affects Create: from n/a through <= 2.9.1.

CVE-2024-11360MedNov 21, 2024
WordPress
Page Parts
risk 0.33cvss 6.1epss 0.01
The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitrary…
CVE-2024-10890MedNov 21, 2024
WordPress
Wpadverts
risk 0.33cvss 6.1epss 0.01
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for…
CVE-2024-10792MedNov 21, 2024
WordPress
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels
risk 0.33cvss 6.1epss 0.01
The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes…
CVE-2024-10726MedNov 21, 2024
WordPress
Friendly Functions For Welcart
risk 0.33cvss 6.1epss 0.00
The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to…
CVE-2024-10682MedNov 21, 2024
WordPress
Announcement & Notification Banner – Bulletin
risk 0.33cvss 6.1epss 0.01
The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg and remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.11.7. This makes it…
CVE-2024-10522MedNov 21, 2024
WordPress
Co Marquage Service Public
risk 0.33cvss 6.1epss 0.01
The Co-marquage service-public.fr plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.5.76. This makes it possible for unauthenticated attackers to…
CVE-2024-11278MedNov 20, 2024
WordPress
Gd Bbpress Attachments
risk 0.33cvss 6.1epss 0.00
The GD bbPress Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.7.2. This makes it possible for unauthenticated attackers to inject…
CVE-2024-10103MedNov 19, 2024
WordPress
MailPoet
risk 0.33cvss 6.1epss 0.00
In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
CVE-2024-8873MedNov 16, 2024
WordPress
PeproDev WooCommerce Receipt Uploader
risk 0.33cvss 6.1epss 0.00
The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated…
CVE-2024-10825MedNov 15, 2024
WordPress
Hide My Wp Ghost
risk 0.33cvss 6.1epss 0.00
The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
CVE-2024-9609MedNov 15, 2024
Thimpress
Learnpress Export Import
risk 0.33cvss 6.1epss 0.00
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and…
CVE-2024-10877MedNov 13, 2024
WordPress
The AFI – The Easiest Integration Plugin
risk 0.33cvss 6.1epss 0.01
The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.92.0. This makes it possible for…
CVE-2024-10684MedNov 13, 2024
Kognetiks
Chatbot
risk 0.33cvss 6.1epss 0.00
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
CVE-2024-10851MedNov 13, 2024
Razorpay
Razorpay Payment Button
risk 0.33cvss 6.1epss 0.01
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for…
CVE-2024-10850MedNov 13, 2024
Razorpay
Razorpay Payment Button
risk 0.33cvss 6.1epss 0.01
The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for…
CVE-2024-10265MedNov 10, 2024
WordPress
Form Maker by 10Web
risk 0.33cvss 6.1epss 0.00
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it…
CVE-2024-10837MedNov 9, 2024
WordPress
Customize My Account For Woocommerce
risk 0.33cvss 6.1epss 0.00
The SysBasics Customize My Account for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 2.7.29 due to insufficient input sanitization and output escaping. This makes it possible for…
CVE-2024-10876MedNov 9, 2024
WordPress
Charitable
risk 0.33cvss 6.1epss 0.00
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to,…
CVE-2024-10647MedNov 6, 2024
WordPress
WS Form LITE
risk 0.33cvss 6.1epss 0.00
The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.244. This makes it…
CVE-2024-9667MedNov 5, 2024
WordPress
Seriously Simple Podcasting
risk 0.33cvss 6.1epss 0.00
The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.0. This makes it possible for unauthenticated attackers to…
CVE-2024-9896MedNov 2, 2024
WordPress
Bbp Core
risk 0.33cvss 6.1epss 0.00
The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible…
CVE-2024-8739MedNov 2, 2024
WordPress
ReCaptcha Integration for WordPress
risk 0.33cvss 6.1epss 0.00
The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers…
CVE-2024-9438MedOct 29, 2024
WordPress
SEUR Oficial
risk 0.33cvss 6.1epss 0.00
The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
CVE-2024-10048MedOct 29, 2024
WordPress
Post Status Notifier Lite
risk 0.33cvss 6.1epss 0.00
The Post Status Notifier Lite and Premium plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.11.6 due to insufficient input sanitization and output escaping. This makes it possible for…
CVE-2024-8870MedOct 26, 2024
WordPress
Forms for Mailchimp by Optin Cat
risk 0.33cvss 6.1epss 0.01
The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for…
CVE-2024-9613MedOct 26, 2024
Formfacade
Formfacade
risk 0.33cvss 6.1epss 0.00
The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This…
CVE-2024-9214MedOct 24, 2024
WordPress
Extra Product Options Builder for WooCommerce
risk 0.33cvss 6.1epss 0.00
The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'RednaoSerializedFields' parameter during the creation of a signature file in all versions up to, and including, 1.2.133 due to insufficient input…
CVE-2024-8717MedOct 24, 2024
WordPress
DearFlip
risk 0.33cvss 6.1epss 0.00
The PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pdf_source' parameter in all versions up to, and including, 2.3.32 due to insufficient input sanitization and output escaping. This…
CVE-2024-9865MedOct 24, 2024
WordPress
Eventprime
risk 0.33cvss 6.1epss 0.00
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping.…
CVE-2024-9864MedOct 24, 2024
WordPress
Eventprime
risk 0.33cvss 6.1epss 0.00
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for…
CVE-2024-9231MedOct 22, 2024
WordPress
WP-Members Membership Plugin
risk 0.33cvss 6.1epss 0.00
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.9.5. This makes it possible for unauthenticated attackers to…
CVE-2024-9219MedOct 19, 2024
Maxfoundry
Social Share Buttons
risk 0.33cvss 6.1epss 0.00
The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.19. This makes it possible for unauthenticated attackers to…
CVE-2024-9206MedOct 18, 2024
MAS Companies
MAS Companies For WP Job Manager
risk 0.33cvss 6.1epss 0.00
The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to…
CVE-2024-9383MedOct 18, 2024
WordPress
Parcel Pro
risk 0.33cvss 6.1epss 0.00
The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
CVE-2024-9213MedOct 17, 2024
WordPress
Persian Woocommerce Sms
risk 0.33cvss 6.1epss 0.00
The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible…
CVE-2024-9347MedOct 17, 2024
WordPress
The Ultimate WordPress Toolkit – WP Extended
risk 0.33cvss 6.1epss 0.00
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible…
CVE-2024-9240MedOct 17, 2024
WordPress
Redi Restaurant Reservation
risk 0.33cvss 6.1epss 0.00
The ReDi Restaurant Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 24.0902. This makes it possible for unauthenticated attackers to…
CVE-2020-36831MedOct 16, 2024
WordPress
NextScripts: Social Networks Auto-Poster
risk 0.33cvss 5.0epss 0.01
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged…
CVE-2024-9647MedOct 16, 2024
Kama SpamBlock
Kama SpamBlock
risk 0.33cvss 6.1epss 0.00
The Kama SpamBlock plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST values in all versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
CVE-2024-8787MedOct 16, 2024
WordPress
Smart Online Order For Clover
risk 0.33cvss 6.1epss 0.00
The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.7. This makes it possible for…
CVE-2024-9610MedOct 11, 2024
WordPress
Language Switcher
risk 0.33cvss 6.1epss 0.00
The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.7.13. This makes it possible for unauthenticated attackers to inject…
CVE-2024-9436MedOct 11, 2024
WordPress
Publishpress Revisions
risk 0.33cvss 6.1epss 0.00
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14.…
CVE-2024-9232MedOct 11, 2024
WordPress
Download Plugins Dashboard
risk 0.33cvss 6.1epss 0.00
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for…
CVE-2024-9221MedOct 11, 2024
Tainacan
Tainacan
risk 0.33cvss 6.1epss 0.00
The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.21.10. This makes it possible for unauthenticated attackers to inject arbitrary web…
CVE-2024-9377MedOct 10, 2024
WordPress
Order Import Export For Woocommerce
risk 0.33cvss 6.1epss 0.00
The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it…
CVE-2024-9207MedOct 8, 2024
WordPress
Buddypress Docs
risk 0.33cvss 6.1epss 0.00
The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to inject…
CVE-2024-8629MedOct 8, 2024
WordPress
WooCommerce Multilingual & Multicurrency with WPML
risk 0.33cvss 6.1epss 0.00
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for…
CVE-2024-44010MedOct 6, 2024
Catchthemes
Full Frame
risk 0.33cvss 5.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Full frame full-frame allows Stored XSS.This issue affects Full frame: from n/a through <= 2.7.2.
CVE-2024-47313MedOct 6, 2024
Catchthemes
Catch Base
risk 0.33cvss 5.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Catch Base catch-base allows Stored XSS.This issue affects Catch Base: from n/a through <= 3.4.6.
CVE-2024-47356MedOct 6, 2024
Catchthemes
Create
risk 0.33cvss 5.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Create create allows Stored XSS.This issue affects Create: from n/a through <= 2.9.1.

Page 609 of 802