PT-2024-41061 · Brest · Brest

Name of the Vulnerable Software and Affected Versions: Brest affected versions not specified Description: The issue is related to the lack of validation of user attribute input data, which can be exploited by a remote attacker to conduct a cross-site scripting XSS attack. Recommendations: At the...

CVE-2024-3672

CVE-2024-3672 affects BA Book Everything, a WordPress plugin. It describes Stored Cross‑Site Scripting via the plugin’s all-items shortcode in all versions up to and including 1.6.8, caused by insufficient input sanitization and output escaping for user-supplied attributes (e.g., classes). The vu...

CVE-2024-1357

CVE-2024-1357 affects the WordPress plugin Shortcodes and extra features for Phlox theme (auxin-elements). It is a Stored XSS in the aux_timeline shortcode caused by insufficient input sanitization and output escaping for attributes like thumb_mode and date_type. Exploitation requires authenticat...

CVE-2024-1357 Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' Shortcode

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auxtimeline shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes such as...

WordPress Otter Blocks plugin <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Block Attributes vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Otter - Gutenberg Block versions = 2.6.8...

CVE-2024-1846

The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-6067

The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...

PT-2024-42028

Name of the Vulnerable Software and Affected Versions LiveJournal Shortcode versions prior to 1.1.2 Description Insufficient input sanitization and output escaping of shortcode attributes allow authenticated users with the contributor role and above to perform Stored Cross-Site Scripting XSS...

CVE-2024-1846: Improper Neutralization of Input During Web Page Generation

The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-6067: Improper Neutralization of Input During Web Page Generation

The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...

PT-2024-14872 · WordPress · Wp User Profile Avatar

Name of the Vulnerable Software and Affected Versions: WP User Profile Avatar WordPress plugin versions 1.0.1 and earlier Description: The issue is related to the WP User Profile Avatar WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them ba...

WordPress Plugin Shortcodes Ultimate has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-3343

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-3343: Improper Neutralization of Input During Web Page Generation

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-2539

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget 'id' attributes in all versions up to, and including, 8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-2735

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2734

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2024-2736

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2024-2666

CVE-2024-2666 affects the Premium Addons for Elementor plugin for WordPress. The Red Hat and initial CVE records describe a DOM-Based Stored Cross-Site Scripting vulnerability in the plugin’s Bullet List Widget, present in all versions up to and including 4.10.24. The issue stems from insufficien...

CVE-2024-2666 Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...