CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7879 – WP ULike < 4.7.5 - Admin+ Stored XSS via Widgets
https://notcve.org/view.php?id=CVE-2024-7879
The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed • https://wpscan.com/vulnerability/5ad1c40a-5e13-40b6-8652-c23a1f39abc2 •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-8444 – Download Manager < 3.3.00 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-8444
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. El complemento Download Manager de WordPress anterior a la versión 3.3.00 no desinfecta algunos de sus parámetros de código corto, lo que genera Cross Site Scripting. • https://wpscan.com/vulnerability/bf2f5aa8-a161-43ff-a6ee-8603aaba8012 •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2024-8625 – TS Poll – Survey, Versus Poll, Image Poll, Video Poll < 2.4.0 - Admin+ SQL Injection
https://notcve.org/view.php?id=CVE-2024-8625
The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks • https://wpscan.com/vulnerability/ab4d7065-4ea2-4233-9593-0f540f91f45e •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-5578 – Table of Contents Plus <= 2408 - Editor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-5578
The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2408 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/641e4fc3-4214-4c2e-8245-15e9dcdd37b4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7876 – Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-7876
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin appointment settings in all versions up to, and including, 1.6.7.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/fffe862f-5bf0-4a05-9d32-caff0bfdb860 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •