CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11330 – Custom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-11330
The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/custom-css/tags/2.3.0/includes/settings/class-alg-custom-css-js-php-settings.php#L299 https://plugins.trac.wordpress.org/changeset/3194786/custom-css/trunk/includes/settings/class-alg-custom-css-js-php-settings.php https://www.wordfence.com/threat-intel/vulnerabilities/id/3497974d-cf58-4b38-a2c9-9bcd119ef43e?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11361 – PDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-11361
The PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/pdf-invoicing-for-woocommerce/tags/2.2.1/includes/class-alg-wc-pdf-invoicing-admin.php#L213 https://plugins.trac.wordpress.org/browser/pdf-invoicing-for-woocommerce/tags/2.2.1/includes/class-alg-wc-pdf-invoicing-admin.php#L244 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194265%40pdf-invoicing-for-woocommerce&new=3194265%40pdf-invoicing-for-woocommerce&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabiliti • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9232 – Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-9232
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ea04ba-b609-49cd-aae8-68f5b51df154?source=cve https://plugins.trac.wordpress.org/browser/download-plugins-dashboard/tags/1.9.1/includes/settings/class-alg-download-plugins-settings.php#L336 https://plugins.trac.wordpress.org/changeset/3165289/#file5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9205 – Maximum Products per User for WooCommerce <= 4.2.8 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-9205
The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/maximum-products-per-user-for-woocommerce/tags/4.2.8/includes/class-alg-wc-mppu-users.php#L836 https://plugins.trac.wordpress.org/changeset/3164534/maximum-products-per-user-for-woocommerce/tags/4.2.9/includes/class-alg-wc-mppu-users.php https://www.wordfence.com/threat-intel/vulnerabilities/id/140c0d22-dc26-4100-a5c0-a2f8a6f98d97?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9384 – Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-9384
The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/wholesale-pricing-woocommerce/tags/3.8.0/includes/settings/class-alg-wc-wholesale-pricing-settings-per-product.php#L126 https://plugins.trac.wordpress.org/changeset/3161269/wholesale-pricing-woocommerce/tags/3.8.1/includes/settings/class-alg-wc-wholesale-pricing-settings-per-product.php https://www.wordfence.com/threat-intel/vulnerabilities/id/e84ee2b5-96b5-427c-ac66-7f80418ae02f?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •