Threat database

The PeproDev Branches Map plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.0.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute when any user accesses the affected page, potentially leading to unauthorized actions or data exposure.

PeproDev Ultimate Profile Solutions WordPress plugin versions up to and including 8.2.36 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user input in the 'button' attribute of the 'logout-url' shortcode. Authenticated users with contributor-level or higher privileges can inject malicious scripts that execute when other users view the affected pages.

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for completed orders which can contain PII of users.

The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-24574 is likely a duplicate of this issue.