deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7769
Published: 2025-05-15
Description: The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/198252c2-834b-401b-98a5-2f59910d67bc/
CVE: CVE-2024-7984
Published: 2025-05-15
Description: The Joy Of Text Lite  WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/07684ecb-5662-4412-8190-7957cfcf7bd3/
CVE: CVE-2024-8009
Published: 2025-05-15
Description: The Sensei LMS  WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/737bb010-b2fa-4bf4-b124-5fbba67cf935/
CVE: CVE-2024-8031
Published: 2025-05-15
Description: The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://wpscan.com/vulnerability/c6f54e6f-0a50-424f-ae3a-00b9880d9f13/
CVE: CVE-2024-8032
Published: 2025-05-15
Description: The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/4c9120b1-ca81-411b-a2e2-a8d30f32a74b/; https://wpscan.com/vulnerability/4c9120b1-ca81-411b-a2e2-a8d30f32a74b/
CVE: CVE-2024-8050
Published: 2025-05-15
Description: The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/28c9c127-464a-4750-8b62-a9b90b01f1af/; https://wpscan.com/vulnerability/28c9c127-464a-4750-8b62-a9b90b01f1af/
CVE: CVE-2024-8082
Published: 2025-05-15
Description: The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/47b2cd60-9ac4-49cf-8ca9-7d90656fc397/; https://wpscan.com/vulnerability/47b2cd60-9ac4-49cf-8ca9-7d90656fc397/
CVE: CVE-2024-8085
Published: 2025-05-15
Description: The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/8b43d3a2-4324-43fd-9c2a-90dbdc1d12a6/; https://wpscan.com/vulnerability/8b43d3a2-4324-43fd-9c2a-90dbdc1d12a6/
CVE: CVE-2024-8090
Published: 2025-05-15
Description: The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/c9dcd450-e8ed-4058-b002-20fb3b879ee0/; https://wpscan.com/vulnerability/c9dcd450-e8ed-4058-b002-20fb3b879ee0/
CVE: CVE-2024-8094
Published: 2025-05-15
Description: The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/cacfde9e-c6fa-4918-8e59-461b67b5e979/; https://wpscan.com/vulnerability/cacfde9e-c6fa-4918-8e59-461b67b5e979/
CVE: CVE-2024-8095
Published: 2025-05-15
Description: The BabelZ  WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/56d22ad0-c5f5-488b-bc1f-73188dfc71d2/; https://wpscan.com/vulnerability/56d22ad0-c5f5-488b-bc1f-73188dfc71d2/
CVE: CVE-2024-8187
Published: 2025-05-15
Description: The Smart Post Show  WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0e51b3b5-f003-4af9-8538-95f266065e36/; https://wpscan.com/vulnerability/0e51b3b5-f003-4af9-8538-95f266065e36/
CVE: CVE-2024-8245
Published: 2025-05-15
Description: The GamiPress  WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/3fb6292c-502c-481a-8223-ecda03d4c3fe/
CVE: CVE-2024-8284
Published: 2025-05-15
Description: The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/93e38b8c-8a2e-4264-b520-ebdbe995d61e/
CVE: CVE-2024-8286
Published: 2025-05-15
Description: The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/628bbac0-76b1-4666-9c00-bae84b48f85c/
CVE: CVE-2024-8397
Published: 2025-05-15
Description: The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/847fbf5d-f7cf-49fd-88bc-d7fa2a8110bd/
CVE: CVE-2024-8398
Published: 2025-05-15
Description: The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/f432901f-31dd-433c-91bf-ec19fa61b6d8/
CVE: CVE-2024-8426
Published: 2025-05-15
Description: The Page Builder: Pagelayer  WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f81b7478-c775-45ff-bbb8-d13c3f58acc6/
CVE: CVE-2024-8492
Published: 2025-05-15
Description: The Hustle  WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c7437eba-8e91-4fcc-82a3-ff8908b36877/
CVE: CVE-2024-8493
Published: 2025-05-15
Description: The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/561b3185-501a-4a75-b880-226b159c0431/
CVE: CVE-2024-8542
Published: 2025-05-15
Description: The Everest Forms  WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e5f94dcf-a6dc-4c4c-acb6-1a7ead701053/
CVE: CVE-2024-8617
Published: 2025-05-15
Description: The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ba6b6b82-6f21-45ff-bd64-685ea8ae1b82/
CVE: CVE-2024-8618
Published: 2025-05-15
Description: The Page Builder: Pagelayer  WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/acddcf33-0a18-499e-b42d-c8b49f2c4de5/; https://wpscan.com/vulnerability/acddcf33-0a18-499e-b42d-c8b49f2c4de5/
CVE: CVE-2024-8619
Published: 2025-05-15
Description: The Ajax Search Lite  WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/84f6733e-028a-4288-b01a-7578a4a89dbe/; https://wpscan.com/vulnerability/84f6733e-028a-4288-b01a-7578a4a89dbe/
CVE: CVE-2024-8620
Published: 2025-05-15
Description: The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d8b0ddd8-0380-4185-aa00-8437e2b617ad/; https://wpscan.com/vulnerability/d8b0ddd8-0380-4185-aa00-8437e2b617ad/
CVE: CVE-2024-8670
Published: 2025-05-15
Description: The Photo Gallery by 10Web  WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/50665594-778b-42f5-bfba-2a249a5e0260/; https://wpscan.com/vulnerability/50665594-778b-42f5-bfba-2a249a5e0260/
CVE: CVE-2024-8673
Published: 2025-05-15
Description: The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
CVSS Score: 9.1 (CRITICAL)
References: https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b[PII_REDACTED]53bf4/; https://wpscan.com/vulnerability/fed2cd26-7ccb-419d-b[PII_REDACTED]53bf4/
CVE: CVE-2024-8699
Published: 2025-05-15
Description: The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/9013351e-224f-4696-970f-eb843dc8dace/; https://wpscan.com/vulnerability/9013351e-224f-4696-970f-eb843dc8dace/
CVE: CVE-2024-8700
Published: 2025-05-15
Description: The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/; https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/
CVE: CVE-2024-8701
Published: 2025-05-15
Description: The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/707d4b5b-8efe-4010-ba7d-80538545a2d5/; https://wpscan.com/vulnerability/707d4b5b-8efe-4010-ba7d-80538545a2d5/
CVE: CVE-2024-8702
Published: 2025-05-15
Description: The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2199ef66-25bd-4eb4-a675-d8b30f047847/
CVE: CVE-2024-8703
Published: 2025-05-15
Description: The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/604e990e-9bec-469e-8630-605eea74e12c/
CVE: CVE-2024-8759
Published: 2025-05-15
Description: The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3dd41ecb-d0dc-4c23-9e5b-b1f7fbaaddfd/
CVE: CVE-2024-8851
Published: 2025-05-15
Description: The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/493f3360-3155-4105-9b5c-60a8605275ab/
CVE: CVE-2024-8854
Published: 2025-05-15
Description: The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bffe0f75-33a2-4270-af13-835b8eb65688/
CVE: CVE-2024-9182
Published: 2025-05-15
Description: The Maspik  WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/40007323-d684-430d-a882-8b4dfb76172b/
CVE: CVE-2024-9227
Published: 2025-05-15
Description: The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bb6515b9-a316-4146-8b7d-9b70a47aa366/
CVE: CVE-2024-9233
Published: 2025-05-15
Description: The Logo Slider  WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/a466cea4-0ae5-44a1-9e12-bd5dbecde2f2/
CVE: CVE-2024-9236
Published: 2025-05-15
Description: The Team  WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fd06ba56-37dd-4c23-ae7c-ab8de40d1645/
CVE: CVE-2024-9238
Published: 2025-05-15
Description: The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a7de0cf6-3064-4595-9037-f8407fe40724/
CVE: CVE-2024-9390
Published: 2025-05-15
Description: The RegistrationMagic  WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6a5308fb-83bf-4f6a-a7ef-e3e1b69aa80f/
CVE: CVE-2024-9450
Published: 2025-05-15
Description: The Free Booking Plugin for Hotels, Restaurants and Car Rentals  WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/f4b9568a-af74-40df-89c1-550e8515ca0a/
CVE: CVE-2024-9599
Published: 2025-05-15
Description: The Popup Box  WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9e8a2659-7a6c-4528-b0b2-64d462485b43/
CVE: CVE-2024-9645
Published: 2025-05-15
Description: The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cfd6db83-5e7f-4631-87c3-fdcd4c64c4fe/
CVE: CVE-2024-9662
Published: 2025-05-15
Description: The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dfa6ff7d-c0dc-4118-afe0-587a24c76f12/
CVE: CVE-2024-9663
Published: 2025-05-15
Description: The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0dbd0927-f245-4202-b96b-e55f36a8bb30/
CVE: CVE-2024-9709
Published: 2025-05-15
Description: The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/9d[PII_REDACTED]-44cb-8198-c105062df2b8/
CVE: CVE-2024-9711
Published: 2025-05-15
Description: The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/daee95c5-006e-4a83-b92a-7faa3e89d985/
CVE: CVE-2024-9765
Published: 2025-05-15
Description: The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/c86157b0-43f3-4e82-9697-7dd9401b48d6/
CVE: CVE-2024-9831
Published: 2025-05-15
Description: The Taskbuilder  WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/390baaf8-a162-43e5-9367-0d2e979d89f7/; https://wpscan.com/vulnerability/390baaf8-a162-43e5-9367-0d2e979d89f7/
CVE: CVE-2024-9838
Published: 2025-05-15
Description: The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/3cc0ff78-b310-40a4-899c-15fecbb345c5/
CVE: CVE-2024-9879
Published: 2025-05-15
Description: The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/cda54097-4aec-472e-a73f-31ecb76ebb23/
CVE: CVE-2024-9882
Published: 2025-05-15
Description: The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7f7667fd-6ac6-4c90-aaf0-c7862bd8e9bd/
CVE: CVE-2025-0329
Published: 2025-05-15
Description: The AI ChatBot for WordPress  WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/db[PII_REDACTED]-46c9-a02e-b1b1b7ace11e/; https://wpscan.com/vulnerability/db[PII_REDACTED]-46c9-a02e-b1b1b7ace11e/