CVE-2024-4845

The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘optionslistid’ parameter in all versions up to, and including, 5.7.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2024-2092

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2092 Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3925

CVE-2024-3925 – Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Vulnerable until 5.6.7 per CVE record; stored XSS via Creative Button widget occurs with authenticated attackers at contributor level or higher. Connected sources confirm the is...

CVE-2024-5892

CVE-2024-5892 affects Divi Torque Lite – Divi Theme and Extra Theme (WordPress) up to version 3.6.6. The vulnerability is a stored Cross‑Site Scripting (XSS) flaw in the SVG/filtered file upload path via the function support_unfiltered_files_upload, exploitable by authenticated users with Author ...

CVE-2024-3559

The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfspostcontent' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2024-4564

The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due to...

CVE-2024-4564

CVE-2024-4564 affects CoDesigner – Elementor Addon for WooCommerce (WordPress) up to version 4.4.1. A stored XSS vulnerability exists in multiple widgets (Shop Slider, Tabs Classic, Image Comparison) due to insufficient input sanitization/output escaping. Exploitation requires at least Contributo...

CVE-2024-5553

CVE-2024-5553 affects Premium Addons for Elementor for WordPress (versions up to and including 4.10.33). It is a DOM-Based Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can i...

CVE-2024-4892

CVE-2024-4892 affects BuddyPress for WordPress. A stored XSS via the display_name parameter exists in BuddyPress versions up to 12.4.1, exploitable by authenticated users with Subscriber+ privileges. The vulnerability context indicates input sanitization/output escaping is insufficient, allowing ...

CVE-2024-36691

Insecure permissions in the AdminController.AjaxSave method of PPGoJobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information...

CVE-2024-37665

An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...

BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library < 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping on...

CVE-2024-36691

PPGo_Jobs v2.8.0 is affected by CVE-2024-36691 due to insecure permissions in AdminController.AjaxSave(). Authenticated users can arbitrarily modify other users’ account information. The vulnerability arises from insufficient access control on the AjaxSave() endpoint. Affected component: AdminCon...

Tenable Security Center Security Breach

Tenable Security Center is a security center from Tenable USA. A security vulnerability exists in Tenable Security Center that stems from the presence of a stored cross-site scripting vulnerability that could allow an authenticated, remote attacker to inject HTML code into a web application scan...

CVE-2024-4669

The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and Schedule widgets in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-5646 Futurio Extra <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget

The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘headersize’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5646

CVE-2024-5646 affects Futurio Extra for WordPress: stored XSS via the header_size field in the Advanced Text Block widget, exploitable by authenticated users with Contributor+ on all versions up to 2.0.5. Patch 2.0.6 fixes the issue; upgrade is required. If patch unavailable in your environment, ...

CVE-2024-4669

The CVE-2024-4669 entry concerns the WordPress plugin Events Addon for Elementor. A Stored Cross-Site Scripting (XSS) vulnerability exists in the Basic Slider, Upcoming Events, and Schedule widgets across all versions up to 2.1.4 due to insufficient input sanitization and output escaping on user-...

CVE-2024-5189

CVE-2024-5189 : The WordPress plugin “Essential Addons for Elementor” (Lite) is affected up to version 5.9.23 by a Stored Cross-Site Scripting (XSS) flaw in the custom_js parameter due to insufficient input sanitization and output escaping. The vulnerability permits authenticated attackers with C...