CVE-2024-12506 NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-11774

CVE-2024-11774 affects the Outdooractive Embed WordPress plugin. The vulnerability is a Stored XSS in the list2go shortcode, exploitable by authenticated users with Contributor+ privileges to inject scripts on pages viewed by others. Affected: Outdooractive Embed, versions up to and including 1.5...

CVE-2024-11783

CVE-2024-11783 : The Financial Calculator WordPress plugin is vulnerable to stored XSS via the plugin shortcode finance_calculator in all versions up to 2.2.1. Authenticated users with Contributor+ privileges can inject scripts that execute when other users load affected pages. Connected Red Hat ...

CVE-2024-11893 Spoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spokibutton' shortcode in all versions up to, and including, 2.15.15 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-11893

CVE-2024-11893 affects the Spoki – Chat Buttons and WooCommerce Notifications WordPress plugin. The vulnerability is a Stored Cross‑Site Scripting flaw via the plugin’s spoki_button shortcode, exploitable by authenticated users with contributor-level access and above. The Initial description indi...

CVE-2024-11783 Financial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Financial Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'financecalculator' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11784 Sell Tickets Online – TicketSource Ticket Shop for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop' shortcode in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11784

CVE-2024-11784 affects the TicketSource Ticket Shop (Sell Tickets Online – TicketSource) WordPress plugin. Per connected documents, all versions up to 3.0.2 are vulnerable to a Stored Cross-Site Scripting (XSS) via the plugin shortcode ticketshop due to insufficient input sanitization and output ...

CVE-2024-9619

CVE-2024-9619 affects the WP SHAPES WordPress plugin. The vulnerability is Stored Cross-Site Scripting via SVG file uploads in all versions up to 1.0.0, caused by insufficient input sanitization and output escaping. It requires authenticated access at Author level or higher to exploit. The connec...

CVE-2024-9619 WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-12509

CVE-2024-12509 – Embed Twine (WordPress) : The WordPress Embed Twine plugin (versions up to 0.1.0) is vulnerable to a Stored Cross-Site Scripting (XSS) via the plugin’s embed_twine shortcode. The root cause is insufficient input sanitization and output escaping on user-provided attributes, enabli...

CVE-2024-11411

The CVE-2024-11411 entry concerns the Spotlightr WordPress plugin, where a Stored Cross-Site Scripting (XSS) flaw exists via the spotlightr-v shortcode. The initial description states versions up to 0.1.9 are affected due to insufficient input sanitization/output escaping for user-supplied attrib...

CVE-2024-11775 Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Particle Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'particleground' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11411 Spotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Spotlightr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode in all versions up to, and including, 0.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11775

CVE-2024-11775 (Particle Background) affects the WordPress plugin Particle Background, vulnerable to stored XSS via the plugin shortcode ‘particleground’ in all versions up to 1.0.2. Documented impact: authenticated attackers with contributor-level access or higher can inject scripts that execute...

CVE-2024-11776 PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-55342

A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS...

WordPress Back Button Widget Plugin < 1.6.4 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpfactory:backbuttonwidget"; if description...

CVE-2024-12331

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajaxinstallplugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2024-12560

The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btnblockduplicatepost' function. This makes it possible for authenticated attackers, with Contributor-leve...