CVE-2024-2803 ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Elementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heading' widgets in all versions up to, and including, 1.4.4.1 due to insufficient input sanitization and output escaping on user supplied...

WordPress Plugin ElementsKit Elementor addons 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Elements kit Elementor addons Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.7 Fixed in 3.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2803 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID 88e697466103 Credits Webbernaut Required...

Shortcode Addons <= 3.2.5 - Authenticated (Admin+) Arbitrary File Upload

Description The Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, wi...

WordPress Creative Addons for Elementor plugin <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by João G. Barbosa 4rCanJ0x! in WordPress Plugin Creative Addons for Elementor versions = 1.5.12...

WordPress Plugin Creative Addons for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Creative Addons for Elementor Plugin <= 1.5.12 is vulnerable to Cross Site Scripting (XSS)

Software Creative Addons for Elementor Type Plugin Vulnerable versions = 1.5.12 Fixed in 1.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2924 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0180e7d18902 Credits João G...

PT-2024-22836 · WordPress · Creative Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Creative Addons for Elementor plugin for WordPress versions up to, and including, 1.5.12 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's widgets, allowing...

WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.7 - Multiple Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Multiple Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Ultimate Addons for Beaver Builder – Lite versions = 1.5.7...

WordPress Essential Addons for Elementor plugin <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword vulnerability

Authenticated Author+ PHP Object Injection via errorresetpassword vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Essential Addons for Elementor versions = 5.9.13...

WordPress PowerPack Addons for Elementor plugin <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag* vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via htmltag vulnerability discovered by wesley wcraft in WordPress Plugin PowerPack Addons for Elementor versions = 2.7.17...

WordPress PowerPack Addons for Elementor plugin <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Twitter Tweet Widget vulnerability discovered by wesley wcraft in WordPress Plugin PowerPack Addons for Elementor versions = 2.7.18...

WordPress Essential Addons for Elementor plugin <= 5.9.13 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Ankit Patel in WordPress Plugin Essential Addons for Elementor versions = 5.9.13...

WordPress ElementsKit Elementor addons plugin <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw vulnerability

Authenticated Contributor+ Local File Inclusion in renderraw vulnerability discovered by wesley wcraft in WordPress Plugin Elements kit Elementor addons versions = 3.0.6...

Piotnet Addons For Elementor < 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and...

WordPress PowerPack Addons for Elementor Plugin <= 2.7.17 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Addons for Elementor Type Plugin Vulnerable versions = 2.7.17 Fixed in 2.7.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2491 Patch priority Low CVSS severity Low 6.5 Developer IdeaBox Creations PSID e7ac7cb26530 Credits wesle...

WordPress Elements kit Elementor addons Plugin <= 3.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1238 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID 8734102af007 Credits wesley wcraft Requir...

Tutor LMS Elementor Addons < 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and...

ElementsKit Elementor addons < 3.0.7 - Contributor+ Local File Inclusion

Description The plugin is vulnerable to Local File Inclusion via the renderraw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This c...