Vulnerabilities > Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

DATE	CVE	VULNERABILITY TITLE	RISK
2024-11-16	CVE-2024-10015	The ConvertCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'type' parameters in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2024-11-16	CVE-2024-10017	The PJW Mime Config plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2024-11-16	CVE-2024-10884	The SimpleForm Contact Form Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.0. network low complexity CWE-79	6.1
2024-11-16	CVE-2024-11092	The SVGPlus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2024-11-16	CVE-2024-8873	The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. network low complexity CWE-79	6.1
2024-11-16	CVE-2024-9386	The Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2024-11-16	CVE-2024-9850	The SVG Case Study plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2024-11-16	CVE-2024-9938	The Bounce Handler MailPoet 3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.3.21 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.1
2024-11-15	CVE-2024-45610	Cross-site Scripting vulnerability in Glpi-Project Glpi GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. network low complexity glpi-project CWE-79	6.1
2024-11-15	CVE-2024-11259	Cross-site Scripting vulnerability in Code-Projects Farmacia 1.0 A vulnerability, which was classified as problematic, has been found in code-projects Farmacia 1.0. network low complexity code-projects CWE-79	6.1