deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13383
Published: 2025-05-15
Description: The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/85bc905d-c960-4399-a879-2d18a4b03007/; https://wpscan.com/vulnerability/85bc905d-c960-4399-a879-2d18a4b03007/
CVE: CVE-2024-13384
Published: 2025-05-15
Description: The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f65d8a83-6ce8-40be-8633-deffd555c349/; https://wpscan.com/vulnerability/f65d8a83-6ce8-40be-8633-deffd555c349/
CVE: CVE-2024-13482
Published: 2025-05-15
Description: The Icegram Engage  WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/83ae33d0-4fc1-4186-9d70-b854a16df3a7/; https://wpscan.com/vulnerability/83ae33d0-4fc1-4186-9d70-b854a16df3a7/
CVE: CVE-2024-13486
Published: 2025-05-15
Description: The Icegram Engage  WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cbba8346-41f6-46ee-89ae-ed9524d768ef/; https://wpscan.com/vulnerability/cbba8346-41f6-46ee-89ae-ed9524d768ef/
CVE: CVE-2024-13616
Published: 2025-05-15
Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/44b3a2d9-a2e1-43dd-b27a-1ad9d6015c9b/; https://wpscan.com/vulnerability/44b3a2d9-a2e1-43dd-b27a-1ad9d6015c9b/
CVE: CVE-2024-13619
Published: 2025-05-15
Description: The LifterLMS  WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/97a7e1a6-0fb3-49e9-86fc-ebb1d426fcca/; https://wpscan.com/vulnerability/97a7e1a6-0fb3-49e9-86fc-ebb1d426fcca/
CVE: CVE-2024-13621
Published: 2025-05-15
Description: The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5b48ecbb-c459-4c39-825d-61744d36f2fe/; https://wpscan.com/vulnerability/5b48ecbb-c459-4c39-825d-61744d36f2fe/
CVE: CVE-2024-13727
Published: 2025-05-15
Description: The MemberSpace  WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/598d20f2-0f42-48f2-a941-0d6c5da5303e/; https://wpscan.com/vulnerability/598d20f2-0f42-48f2-a941-0d6c5da5303e/
CVE: CVE-2024-13729
Published: 2025-05-15
Description: The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2feed26b-ef02-4954-ab9d-8b0f958b0ef1/; https://wpscan.com/vulnerability/2feed26b-ef02-4954-ab9d-8b0f958b0ef1/
CVE: CVE-2024-13730
Published: 2025-05-15
Description: The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4541a285-a095-4178-a64b-6a859eb5034e/; https://wpscan.com/vulnerability/4541a285-a095-4178-a64b-6a859eb5034e/
CVE: CVE-2024-13823
Published: 2025-05-15
Description: The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dcfd8a03-0a04-4fd1-986d-1e816b1fad19/; https://wpscan.com/vulnerability/dcfd8a03-0a04-4fd1-986d-1e816b1fad19/
CVE: CVE-2024-13828
Published: 2025-05-15
Description: The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0f901807-9ef2-4cd3-969a-9fd23a8da371/; https://wpscan.com/vulnerability/0f901807-9ef2-4cd3-969a-9fd23a8da371/
CVE: CVE-2024-13865
Published: 2025-05-15
Description: The S3Player  WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9cc7c5cb-983f-4593-abc5-7e224b275a23/; https://wpscan.com/vulnerability/9cc7c5cb-983f-4593-abc5-7e224b275a23/
CVE: CVE-2024-1663
Published: 2025-05-15
Description: The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6d101f2b-e903-4e64-92cc-e550abb52d6f/; https://wpscan.com/vulnerability/6d101f2b-e903-4e64-92cc-e550abb52d6f/
CVE: CVE-2024-2643
Published: 2025-05-15
Description: The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any   WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/194ebf81-8fe4-4c74-8174-35d0ac00ac93/; https://wpscan.com/vulnerability/194ebf81-8fe4-4c74-8174-35d0ac00ac93/
CVE: CVE-2024-2869
Published: 2025-05-15
Description: The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4093c12e-f62b-4357-8893-649cd2aaeace/; https://wpscan.com/vulnerability/4093c12e-f62b-4357-8893-649cd2aaeace/
CVE: CVE-2024-3062
Published: 2025-05-15
Description: The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1526985d-2f8f-4b2a-97f3-633c51d024b8/; https://wpscan.com/vulnerability/1526985d-2f8f-4b2a-97f3-633c51d024b8/
CVE: CVE-2024-3901
Published: 2025-05-15
Description: The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9502e1ac-346e-4431-90a6-61143d2df37b/
CVE: CVE-2024-3996
Published: 2025-05-15
Description: The Smart Post Show  WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4035e3f9-89fe-49e1-8aa2-55ab3f1aa528/
CVE: CVE-2024-4002
Published: 2025-05-15
Description: The Carousel, Slider, Gallery by WP Carousel  WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/298b51ec-afad-4bc1-968d-76c59e55fc05/
CVE: CVE-2024-4004
Published: 2025-05-15
Description: The Advanced Cron Manager  WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8e5e7040-b824-4af7-90a1-90801d12abb6/
CVE: CVE-2024-4091
Published: 2025-05-15
Description: The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e28e79fa-f461-41fe-ad1c-ca768ea5f982/
CVE: CVE-2024-4665
Published: 2025-05-15
Description: The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.
CVSS Score: 6.4 (MEDIUM)
References: https://wpscan.com/vulnerability/50b78cac-cad1-4526-9655-ae[PII_REDACTED]/
CVE: CVE-2024-5026
Published: 2025-05-15
Description: The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a86584f6-119b-45c3-bc6e-dc18e3501db7/; https://wpscan.com/vulnerability/a86584f6-119b-45c3-bc6e-dc18e3501db7/
CVE: CVE-2024-5440
Published: 2025-05-15
Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/52fdc271-96f2-4e25-9df2-29a3ce06328c/; https://wpscan.com/vulnerability/52fdc271-96f2-4e25-9df2-29a3ce06328c/
CVE: CVE-2024-6159
Published: 2025-05-15
Description: The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/de20ebda-b0bc-489e-a8d3-e9487a2b48e8/; https://wpscan.com/vulnerability/de20ebda-b0bc-489e-a8d3-e9487a2b48e8/
CVE: CVE-2024-6335
Published: 2025-05-15
Description: The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3bfb6b3f-8642-4807-b6b3-f214b26e96c2/; https://wpscan.com/vulnerability/3bfb6b3f-8642-4807-b6b3-f214b26e96c2/
CVE: CVE-2024-6462
Published: 2025-05-15
Description: The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0880fa33-3efa-4f50-83c8-4c90cb805eb9/; https://wpscan.com/vulnerability/0880fa33-3efa-4f50-83c8-4c90cb805eb9/
CVE: CVE-2024-6478
Published: 2025-05-15
Description: The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/39a78741-eeae-4a27-8136-7d0bb0bf2263/; https://wpscan.com/vulnerability/39a78741-eeae-4a27-8136-7d0bb0bf2263/
CVE: CVE-2024-6486
Published: 2025-05-15
Description: The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/; https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/
CVE: CVE-2024-6584
Published: 2025-05-15
Description: The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://wpscan.com/vulnerability/eaa57c8c-1cac-4903-9763-79f7f84469fa/
CVE: CVE-2024-6665
Published: 2025-05-15
Description: The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a0b3335f-6e04-402f-8cfd-fc4c62e52168/
CVE: CVE-2024-6667
Published: 2025-05-15
Description: The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d2b8ca6c-2b14-4d72-8e39-0f3ca5c23f56/
CVE: CVE-2024-6668
Published: 2025-05-15
Description: The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8faf1409-44e6-4ebf-9a68-b5f93a5295e9/; https://wpscan.com/vulnerability/8faf1409-44e6-4ebf-9a68-b5f93a5295e9/
CVE: CVE-2024-6690
Published: 2025-05-15
Description: The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://wpscan.com/vulnerability/09c6848d-30dc-4382-ae74-b470f586e142/; https://wpscan.com/vulnerability/09c6848d-30dc-4382-ae74-b470f586e142/
CVE: CVE-2024-6693
Published: 2025-05-15
Description: The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2b1af7eb-452a-43f4-aae9-edd8e7312fe8/; https://wpscan.com/vulnerability/2b1af7eb-452a-43f4-aae9-edd8e7312fe8/
CVE: CVE-2024-6708
Published: 2025-05-15
Description: The User Profile Builder  WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b6822bd9-f9f9-41a4-ad19-019b1f03bd4c/; https://wpscan.com/vulnerability/b6822bd9-f9f9-41a4-ad19-019b1f03bd4c/
CVE: CVE-2024-6711
Published: 2025-05-15
Description: The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bf431b81-2db9-4fcb-841c-9b51d1870bf8/
CVE: CVE-2024-6712
Published: 2025-05-15
Description: The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0346b62c-a856-4554-a24a-ef2c2943bda9/; https://wpscan.com/vulnerability/0346b62c-a856-4554-a24a-ef2c2943bda9/
CVE: CVE-2024-6713
Published: 2025-05-15
Description: The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/24685b19-0a44-411a-9e1b-d4d0627d7cb6/; https://wpscan.com/vulnerability/24685b19-0a44-411a-9e1b-d4d0627d7cb6/
CVE: CVE-2024-6718
Published: 2025-05-15
Description: The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7d28ea72-8c3b-4607-b877-7b10d954fef9/; https://wpscan.com/vulnerability/7d28ea72-8c3b-4607-b877-7b10d954fef9/
CVE: CVE-2024-6719
Published: 2025-05-15
Description: The Offload Videos  WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1dc7caac-a36e-4313-a8be-c6b13e564924/; https://wpscan.com/vulnerability/1dc7caac-a36e-4313-a8be-c6b13e564924/
CVE: CVE-2024-6797
Published: 2025-05-15
Description: The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/14275493-45fd-470c-958f-feded435f706/; https://wpscan.com/vulnerability/14275493-45fd-470c-958f-feded435f706/
CVE: CVE-2024-6798
Published: 2025-05-15
Description: The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c719922e-b2b3-452f-856a-5cc983a4ac18/
CVE: CVE-2024-6809
Published: 2025-05-15
Description: The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/60abcae5-4c89-4d48-95f8-6a80e5f06a37/
CVE: CVE-2024-7556
Published: 2025-05-15
Description: The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/89ccbe24-be15-4b13-883a-48d6da9c8ffa/
CVE: CVE-2024-7758
Published: 2025-05-15
Description: The Stylish Price List  WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0bf39a29-a605-407b-9ab0-a82437d16153/
CVE: CVE-2024-7759
Published: 2025-05-15
Description: The PWA for WP  WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6e495b39-f9ef-45dd-b839-65c71a082f2b/
CVE: CVE-2024-7761
Published: 2025-05-15
Description: In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ae8c1c91-3574-4da5-b5dc-d4e3feccac7e/
CVE: CVE-2024-7762
Published: 2025-05-15
Description: The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes
CVSS Score: 3.7 (LOW)
References: https://wpscan.com/vulnerability/26403e72-c927-4649-b789-694a10ad0492/