deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4709
Published: 2025-05-15
Description: A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/transaction_del.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/3; https://vuldb.com/?ctiid.309007; https://vuldb.com/?id.309007
CVE: CVE-2025-4710
Published: 2025-05-15
Description: A vulnerability, which was classified as critical, has been found in Campcodes Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/transaction.php. The manipulation of the argument cid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/4; https://vuldb.com/?ctiid.309008; https://vuldb.com/?id.309008
CVE: CVE-2025-4711
Published: 2025-05-15
Description: A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /pages/stockin_add.php. The manipulation of the argument prod_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/5; https://vuldb.com/?ctiid.309009; https://vuldb.com/?id.309009
CVE: CVE-2024-51666
Published: 2025-05-15
Description: Missing Authorization vulnerability in Tosin Oguntuyi Tours tours.This issue affects Tours: from n/a through <= 1.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/tours/vulnerability/wordpress-tours-plugin-1-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-56006
Published: 2025-05-15
Description: Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/jetpack-debug-helper/vulnerability/wordpress-jetpack-debug-tools-plugin-2-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-26481
Published: 2025-05-15
Description: Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0, contains an uncontrolled resource consumption vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.dell.com/support/kbdoc/en-us/000256645/dsa-2024-453-security-update-for-dell-powerscale-onefs-multiple-security-vulnerabilities
CVE: CVE-2025-30475
Published: 2025-05-15
Description: Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000317889/dsa-2025-186-security-update-for-dell-powerscale-inightiq-multiple-security-vulnerabilities
CVE: CVE-2025-30476
Published: 2025-05-15
Description: Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://www.dell.com/support/kbdoc/en-us/000317889/dsa-2025-186-security-update-for-dell-powerscale-inightiq-multiple-security-vulnerabilities
CVE: CVE-2025-32922
Published: 2025-05-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Stored XSS.This issue affects WP2LEADS: from n/a through <= 3.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-4712
Published: 2025-05-15
Description: A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/account_summary.php. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/6; https://vuldb.com/?ctiid.309010; https://vuldb.com/?id.309010
CVE: CVE-2025-4713
Published: 2025-05-15
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/print.php. The manipulation of the argument sid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/7; https://vuldb.com/?ctiid.309011; https://vuldb.com/?id.309011
CVE: CVE-2025-4714
Published: 2025-05-15
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/reprint.php. The manipulation of the argument sid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/8; https://vuldb.com/?ctiid.309012; https://vuldb.com/?id.309012
CVE: CVE-2023-2334
Published: 2025-05-15
Description: The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/95562684-2bb1-46f0-838c-8501db6b43ed/
CVE: CVE-2023-5529
Published: 2025-05-15
Description: The Advanced Page Visit Counter  WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/095c9c35-2618-4f90-8435-a3c34f0bb7f1/
CVE: CVE-2023-5932
Published: 2025-05-15
Description: The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/16fbca64-cc35-455e-bfef-d1f28857f991/
CVE: CVE-2023-5934
Published: 2025-05-15
Description: The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack
CVSS Score: 7.3 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/2a45cdba-df41-457e-bff9-2d6d89776dd0/
CVE: CVE-2023-6030
Published: 2025-05-15
Description: The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/b658e403-006c-4555-b1b2-3603e44f4411/
CVE: CVE-2023-6541
Published: 2025-05-15
Description: The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bbe866b8-7497-4e5c-8f59-bb8edac1dc71/
CVE: CVE-2023-6783
Published: 2025-05-15
Description: The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5acd231b-4072-4ee1-[PII_REDACTED]/; https://wpscan.com/vulnerability/5acd231b-4072-4ee1-[PII_REDACTED]/
CVE: CVE-2023-6786
Published: 2025-05-15
Description: The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://wpscan.com/vulnerability/f3e64947-3138-4ec4-86c4-27b5d6a5c9c2/
CVE: CVE-2023-7086
Published: 2025-05-15
Description: The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/94954e1a-dc09-4811-b57d-b12bf69a767d/
CVE: CVE-2023-7088
Published: 2025-05-15
Description: The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8f515e36-9072-4fc4-9d2f-d50f1adde626/
CVE: CVE-2023-7168
Published: 2025-05-15
Description: The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/715ded45-04ee-40c1-8acb-bd40d0fe30ec/; https://wpscan.com/vulnerability/715ded45-04ee-40c1-8acb-bd40d0fe30ec/
CVE: CVE-2023-7174
Published: 2025-05-15
Description: The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/9c1c6d61-5588-4c21-95f6-2818c4f5c355/; https://wpscan.com/vulnerability/9c1c6d61-5588-4c21-95f6-2818c4f5c355/
CVE: CVE-2023-7195
Published: 2025-05-15
Description: The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/72279ca0-6365-4c83-adca-4d8e5808a8c5/; https://wpscan.com/vulnerability/72279ca0-6365-4c83-adca-4d8e5808a8c5/
CVE: CVE-2023-7196
Published: 2025-05-15
Description: The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/15ea1ffd-5a0c-422c-8c9c-7b632516a156/; https://wpscan.com/vulnerability/15ea1ffd-5a0c-422c-8c9c-7b632516a156/
CVE: CVE-2023-7197
Published: 2025-05-15
Description: The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/26deaa7c-e331-42a0-9310-31d08871154c/; https://wpscan.com/vulnerability/26deaa7c-e331-42a0-9310-31d08871154c/
CVE: CVE-2023-7228
Published: 2025-05-15
Description: The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site Scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1ddf1271-3826-44e2-8408-cfbe9c3cc547/
CVE: CVE-2023-7229
Published: 2025-05-15
Description: The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/d16f6ba0-a47d-413f-a6d4[PII_REDACTED]09/
CVE: CVE-2023-7230
Published: 2025-05-15
Description: The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/402e428b-f966-4a36-ace0-d0ded9410b1d/
CVE: CVE-2023-7231
Published: 2025-05-15
Description: The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links.
CVSS Score: 7.3 (HIGH)
References: https://wpscan.com/vulnerability/797692ce-f355-4d4a-af01-4bd9abc60a34/
CVE: CVE-2023-7239
Published: 2025-05-15
Description: The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/6e6afe50-27f9-41fa-a94b-f44df0850e2c/
CVE: CVE-2023-7297
Published: 2025-05-15
Description: The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://wpscan.com/vulnerability/3632dfa1-2948-4622-a8fd-31edb8b22383/
CVE: CVE-2024-0249
Published: 2025-05-15
Description: The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e7ee3e73-1086-421f-b586-d415a45a6c8e/
CVE: CVE-2024-0852
Published: 2025-05-15
Description: The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/743c4d79-e1d5-4fb0-a17d-296df2c54e8a/
CVE: CVE-2024-0970
Published: 2025-05-15
Description: This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/7df6877c-6640-41be-aacb-20c7da61e4db/
CVE: CVE-2024-10009
Published: 2025-05-15
Description: The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/c2b1f9f4-d5f3-4975-afd1-50eaf193e2ab/; https://wpscan.com/vulnerability/c2b1f9f4-d5f3-4975-afd1-50eaf193e2ab/
CVE: CVE-2024-10054
Published: 2025-05-15
Description: The Happyforms  WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5a9fd64b-3207-4acb-92ff-1cca08c41ac9/; https://wpscan.com/vulnerability/5a9fd64b-3207-4acb-92ff-1cca08c41ac9/
CVE: CVE-2024-10075
Published: 2025-05-15
Description: The Jetpack  WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
CVSS Score: 5.6 (MEDIUM)
References: https://wpscan.com/vulnerability/a984976c-291a-4f68-90d4-e452605ea7d1/; https://wpscan.com/vulnerability/a984976c-291a-4f68-90d4-e452605ea7d1/
CVE: CVE-2024-10076
Published: 2025-05-15
Description: The Jetpack  WordPress plugin before 13.8, Jetpack Boost  WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/15f278f6-0418-4c83-b925-b1a2d8c53e2f/; https://wpscan.com/vulnerability/15f278f6-0418-4c83-b925-b1a2d8c53e2f/
CVE: CVE-2024-10098
Published: 2025-05-15
Description: The ApplyOnline  WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain
CVSS Score: 2.7 (LOW)
References: https://wpscan.com/vulnerability/242dac1f-9a1f-4fde-b8c7-374bd451071d/; https://wpscan.com/vulnerability/242dac1f-9a1f-4fde-b8c7-374bd451071d/
CVE: CVE-2024-10107
Published: 2025-05-15
Description: The Giveaways and Contests by RafflePress  WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/83590cad-6bfb-4dc7-b8fd-aecbc66f3c33/; https://wpscan.com/vulnerability/83590cad-6bfb-4dc7-b8fd-aecbc66f3c33/
CVE: CVE-2024-10143
Published: 2025-05-15
Description: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b5fd7a3e-33e4-4c73-a581-881f063855b0/; https://wpscan.com/vulnerability/b5fd7a3e-33e4-4c73-a581-881f063855b0/
CVE: CVE-2024-10144
Published: 2025-05-15
Description: The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a83521d3-0aba-493d-8dec-e764277e69b8/; https://wpscan.com/vulnerability/a83521d3-0aba-493d-8dec-e764277e69b8/
CVE: CVE-2024-10145
Published: 2025-05-15
Description: The Hubbub Lite  WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b9e2381b-3ea0-48fa-bd9c-4181ddf36389/; https://wpscan.com/vulnerability/b9e2381b-3ea0-48fa-bd9c-4181ddf36389/
CVE: CVE-2024-10149
Published: 2025-05-15
Description: The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1619dc4b-4e5e-4b82-820b-3c4e732db3ad/; https://wpscan.com/vulnerability/1619dc4b-4e5e-4b82-820b-3c4e732db3ad/
CVE: CVE-2024-10362
Published: 2025-05-15
Description: The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/701f653b-a0c3-49b4-972e-f26c3633ad92/; https://wpscan.com/vulnerability/701f653b-a0c3-49b4-972e-f26c3633ad92/
CVE: CVE-2024-10475
Published: 2025-05-15
Description: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/faca59fb-6b59-45b0-8b97-c4125d9d3cb3/; https://wpscan.com/vulnerability/faca59fb-6b59-45b0-8b97-c4125d9d3cb3/
CVE: CVE-2024-10504
Published: 2025-05-15
Description: The Contact Form, Survey, Quiz & Popup Form Builder  WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9a22df11-0e24-4248-a8f3-da8f23ccb313/; https://wpscan.com/vulnerability/9a22df11-0e24-4248-a8f3-da8f23ccb313/
CVE: CVE-2024-10631
Published: 2025-05-15
Description: The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b153fb5e-7df2-491b-b61b-6f90314c7b04/; https://wpscan.com/vulnerability/b153fb5e-7df2-491b-b61b-6f90314c7b04/
CVE: CVE-2024-10632
Published: 2025-05-15
Description: The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/17afba70-f213-47f6-aea2-59288ca92549/