deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10634
Published: 2025-05-15
Description: The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset the Nokaut Offers Box WordPress plugin through 1.4.0 via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/97de2ca3-ee64-480b-a5b0-7549533c2936/; https://wpscan.com/vulnerability/97de2ca3-ee64-480b-a5b0-7549533c2936/
CVE: CVE-2024-10639
Published: 2025-05-15
Description: The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/efab3a36-535b-40ff-b98f-482a0e5193f1/; https://wpscan.com/vulnerability/efab3a36-535b-40ff-b98f-482a0e5193f1/
CVE: CVE-2024-10677
Published: 2025-05-15
Description: The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/b1bd4216-798a-4e45-a0ba-3699f0af3c7a/; https://wpscan.com/vulnerability/b1bd4216-798a-4e45-a0ba-3699f0af3c7a/
CVE: CVE-2024-10818
Published: 2025-05-15
Description: The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/aafd152c-1a05-4191-a1bc-b802d801ca03/; https://wpscan.com/vulnerability/aafd152c-1a05-4191-a1bc-b802d801ca03/
CVE: CVE-2024-11109
Published: 2025-05-15
Description: The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/93619da1-a8d6-43b6-b1be-8d50ab6f29f7/; https://wpscan.com/vulnerability/93619da1-a8d6-43b6-b1be-8d50ab6f29f7/
CVE: CVE-2024-11140
Published: 2025-05-15
Description: The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b3448dff-a839-45aa-8d5a-d359e50ab7fd/; https://wpscan.com/vulnerability/b3448dff-a839-45aa-8d5a-d359e50ab7fd/
CVE: CVE-2024-11141
Published: 2025-05-15
Description: The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6fe3544b-fb86-43e4-9771-6e9343f9f835/; https://wpscan.com/vulnerability/6fe3544b-fb86-43e4-9771-6e9343f9f835/
CVE: CVE-2024-11189
Published: 2025-05-15
Description: The Social Share And Social Locker  WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f3d1473a-6d25-447d-af27-f315323fdd62/; https://wpscan.com/vulnerability/f3d1473a-6d25-447d-af27-f315323fdd62/
CVE: CVE-2024-11190
Published: 2025-05-15
Description: The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/66b914ba-4253-4849-a38a-05ab246a9a32/; https://wpscan.com/vulnerability/66b914ba-4253-4849-a38a-05ab246a9a32/
CVE: CVE-2024-11221
Published: 2025-05-15
Description: The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/810c2c94-5d35-419c-a993-07a0c7064ce6/; https://wpscan.com/vulnerability/810c2c94-5d35-419c-a993-07a0c7064ce6/
CVE: CVE-2024-11266
Published: 2025-05-15
Description: The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/361a4635-7e7d-483c-b2ce-a857d60d91ea/; https://wpscan.com/vulnerability/361a4635-7e7d-483c-b2ce-a857d60d91ea/
CVE: CVE-2024-11267
Published: 2025-05-15
Description: The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor to perform SQL injection attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/fcbdc11a-a194-46e4-8c22-11010b98fdab/; https://wpscan.com/vulnerability/fcbdc11a-a194-46e4-8c22-11010b98fdab/
CVE: CVE-2024-11269
Published: 2025-05-15
Description: The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/3ad89687-adb0-4c45-938c-0c18fda7f36f/; https://wpscan.com/vulnerability/3ad89687-adb0-4c45-938c-0c18fda7f36f/
CVE: CVE-2024-11372
Published: 2025-05-15
Description: The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/de74199a-001e-4388-82ae-70cfd5a49457/; https://wpscan.com/vulnerability/de74199a-001e-4388-82ae-70cfd5a49457/
CVE: CVE-2024-11373
Published: 2025-05-15
Description: The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/e9ef847f-3a3f-4030-828b-78db0044e142/; https://wpscan.com/vulnerability/e9ef847f-3a3f-4030-828b-78db0044e142/
CVE: CVE-2024-11502
Published: 2025-05-15
Description: The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d9bea52e-af32-449f-97b6-1dcfb2051bda/; https://wpscan.com/vulnerability/d9bea52e-af32-449f-97b6-1dcfb2051bda/
CVE: CVE-2024-11718
Published: 2025-05-15
Description: The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/02da3a49-20e4-4476-a78d-4c627994a90a/; https://wpscan.com/vulnerability/02da3a49-20e4-4476-a78d-4c627994a90a/
CVE: CVE-2024-11719
Published: 2025-05-15
Description: The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/64c2a296-5fc6-450e-a12d-75cbf8b73e3a/; https://wpscan.com/vulnerability/64c2a296-5fc6-450e-a12d-75cbf8b73e3a/
CVE: CVE-2024-11843
Published: 2025-05-15
Description: The Panorama  WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0dd41559-d88a-4018-a0f0-c8944b6d6f0a/; https://wpscan.com/vulnerability/0dd41559-d88a-4018-a0f0-c8944b6d6f0a/
CVE: CVE-2024-12282
Published: 2025-05-15
Description: The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/2d81f038-e2bb-4906-a954-78dc971ed793/; https://wpscan.com/vulnerability/2d81f038-e2bb-4906-a954-78dc971ed793/
CVE: CVE-2024-12301
Published: 2025-05-15
Description: The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/5d93db07-415f-475b-a76d-2e12f849a4dc/; https://wpscan.com/vulnerability/5d93db07-415f-475b-a76d-2e12f849a4dc/
CVE: CVE-2024-12679
Published: 2025-05-15
Description: The Prisna GWT  WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7ca1438f-4269-4e34-be4a-766276a9f016/; https://wpscan.com/vulnerability/7ca1438f-4269-4e34-be4a-766276a9f016/
CVE: CVE-2024-12680
Published: 2025-05-15
Description: The Prisna GWT  WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/28537fbc-3c2b-40c1-85f0-8b5f94eaad51/; https://wpscan.com/vulnerability/28537fbc-3c2b-40c1-85f0-8b5f94eaad51/
CVE: CVE-2024-12716
Published: 2025-05-15
Description: The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a9fa48f1-d7fd-4968-a122-937803f186a2/; https://wpscan.com/vulnerability/a9fa48f1-d7fd-4968-a122-937803f186a2/
CVE: CVE-2024-12722
Published: 2025-05-15
Description: The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c3be5990-ca89-4ac4-baae-49af55df9d57/; https://wpscan.com/vulnerability/c3be5990-ca89-4ac4-baae-49af55df9d57/
CVE: CVE-2024-12724
Published: 2025-05-15
Description: The WP DeskLite  WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9dd3ffaa-9020-47a6-bf9a-7e1412b9e9d5/; https://wpscan.com/vulnerability/9dd3ffaa-9020-47a6-bf9a-7e1412b9e9d5/
CVE: CVE-2024-12725
Published: 2025-05-15
Description: The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a174c640-6994-4028-a8a3-c470d5612304/; https://wpscan.com/vulnerability/a174c640-6994-4028-a8a3-c470d5612304/
CVE: CVE-2024-12726
Published: 2025-05-15
Description: The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/88d748fc-6c2f-4656-99c5-c00cbed9d7e0/; https://wpscan.com/vulnerability/88d748fc-6c2f-4656-99c5-c00cbed9d7e0/
CVE: CVE-2024-12732
Published: 2025-05-15
Description: The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bc46edd8-8d77-4567-873b-e9e90a01adcf/; https://wpscan.com/vulnerability/bc46edd8-8d77-4567-873b-e9e90a01adcf/
CVE: CVE-2024-12733
Published: 2025-05-15
Description: The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/61be935e-ecb4-45be-8553-65877dd42569/; https://wpscan.com/vulnerability/61be935e-ecb4-45be-8553-65877dd42569/
CVE: CVE-2024-12734
Published: 2025-05-15
Description: The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/038b44dc-0495-4f56-ae7e-c78a265aa535/; https://wpscan.com/vulnerability/038b44dc-0495-4f56-ae7e-c78a265aa535/
CVE: CVE-2024-12735
Published: 2025-05-15
Description: The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above to perform SQL injection attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/1b355399-e92b-46aa-ada1-95e99fc03976/; https://wpscan.com/vulnerability/1b355399-e92b-46aa-ada1-95e99fc03976/
CVE: CVE-2024-12739
Published: 2025-05-15
Description: The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5492f1b2-481b-472a-82d3-949f85c8dc70/; https://wpscan.com/vulnerability/5492f1b2-481b-472a-82d3-949f85c8dc70/
CVE: CVE-2024-12743
Published: 2025-05-15
Description: The MailPoet  WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7945f52d-364d-438c-84f2-cf19b4250056/; https://wpscan.com/vulnerability/7945f52d-364d-438c-84f2-cf19b4250056/
CVE: CVE-2024-12750
Published: 2025-05-15
Description: The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/f3570bdc-659f-4a03-96f8-b4f9f045f910/; https://wpscan.com/vulnerability/f3570bdc-659f-4a03-96f8-b4f9f045f910/
CVE: CVE-2024-12767
Published: 2025-05-15
Description: The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts
CVSS Score: 3.5 (LOW)
CWE: CWE-639
References: https://wpscan.com/vulnerability/e8997f90-d8e9-4815-8808-aa0183443dae/
CVE: CVE-2024-12770
Published: 2025-05-15
Description: The WP ULike  WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e21f6a4e-f385-411b-8d91-0f38f9e6cdd3/; https://wpscan.com/vulnerability/e21f6a4e-f385-411b-8d91-0f38f9e6cdd3/
CVE: CVE-2024-12800
Published: 2025-05-15
Description: The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8f1ceca5-3b7b-4cf0-bccd-03e204e5bfad/; https://wpscan.com/vulnerability/8f1ceca5-3b7b-4cf0-bccd-03e204e5bfad/
CVE: CVE-2024-12808
Published: 2025-05-15
Description: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f1f823f5-d0f1-45a5-85c2-60208d76366e/; https://wpscan.com/vulnerability/f1f823f5-d0f1-45a5-85c2-60208d76366e/
CVE: CVE-2024-12812
Published: 2025-05-15
Description: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://wpscan.com/vulnerability/757e76fd-830f-4d1c-8b89-dfad7c9c1f37/; https://wpscan.com/vulnerability/757e76fd-830f-4d1c-8b89-dfad7c9c1f37/
CVE: CVE-2024-12873
Published: 2025-05-15
Description: The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3e82d45f-7b8f-424e-a8d7-be64f5acf65e/; https://wpscan.com/vulnerability/3e82d45f-7b8f-424e-a8d7-be64f5acf65e/
CVE: CVE-2024-12874
Published: 2025-05-15
Description: The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7cc14a87-4605-49f6-9d51-0b9eb57e6c9d/; https://wpscan.com/vulnerability/7cc14a87-4605-49f6-9d51-0b9eb57e6c9d/
CVE: CVE-2024-13053
Published: 2025-05-15
Description: The Form Maker by 10Web  WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1c667a70-8b38-4854-8969-2971f9c2fe79/; https://wpscan.com/vulnerability/1c667a70-8b38-4854-8969-2971f9c2fe79/
CVE: CVE-2024-13127
Published: 2025-05-15
Description: The LearnPress  WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/003ac248-74db-4b83-af0b-aa37ffb9b3d3/; https://wpscan.com/vulnerability/003ac248-74db-4b83-af0b-aa37ffb9b3d3/
CVE: CVE-2024-13128
Published: 2025-05-15
Description: The LearnPress  WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1506a339-f85a-408a-8efa-ca83eb3b3ffb/; https://wpscan.com/vulnerability/1506a339-f85a-408a-8efa-ca83eb3b3ffb/
CVE: CVE-2024-13313
Published: 2025-05-15
Description: The AWeber  WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cc35b2f4-f1f1-4ed3-91b2-025bd5848b29/; https://wpscan.com/vulnerability/cc35b2f4-f1f1-4ed3-91b2-025bd5848b29/
CVE: CVE-2024-13357
Published: 2025-05-15
Description: The Ditty  WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d134bb34-6324-4bc8-943e-4e743d00fcb2/; https://wpscan.com/vulnerability/d134bb34-6324-4bc8-943e-4e743d00fcb2/
CVE: CVE-2024-13382
Published: 2025-05-15
Description: The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/925de4af-fc71-45ae-8454-7e4f70be13ca/; https://wpscan.com/vulnerability/925de4af-fc71-45ae-8454-7e4f70be13ca/