12917 matches found
CVE-2024-5188
CVE-2024-5188 describes a Stored Cross‑Site Scripting flaw in the WordPress plugin Essential Addons for Elementor – Lite (Best Elementor Templates, Widgets, Kits & WooCommerce Builders). The issue is due to insufficient input sanitization and output escaping in the function get_manual_calendar_ev...
CVE-2024-5038
CVE-2024-5038 affects Colibri Page Builder for WordPress. The vulnerability is Stored Cross-Site Scripting via the plugin’s shortcode attributes in all versions up to 1.0.276, caused by insufficient input sanitization and output escaping. It requires an authenticated attacker with contributor-lev...
CVE-2024-5329
The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to blind SQL Injection via the ‘dataaddonID’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...
CVE-2024-5259
CVE-2024-5259 affects the MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress. It allows Stored XSS via the hover_animation parameter in all versions up to 4.1.11, enabling authenticated attackers with Contributor-level access or higher to inject scripts o...
CVE-2024-5221
The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...
CVE-2024-5221
The CVE-2024-5221 entry concerns the Qi Blocks WordPress plugin. Public records here show a Stored XSS vulnerability in the plugin’s file uploader affecting all versions up to and including 1.2.9, caused by insufficient input sanitization and output escaping. Exploitation requires authentication ...
CVE-2024-5656
Rejected reason: REJECT Accidental duplicate assignment of CVE-2024-4755. Please use CVE-2024-4755...
CVE-2024-5656
CVE-2024-5656 is a duplicate of CVE-2024-4755. The connected records confirm CVE-2024-4755 affects Google CSE WordPress plugin versions
CVE-2024-5162
The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...
CVE-2024-5141
The Rotating Tweets Twitter widget and shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's' 'rotatingtweets' in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-5152
The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 6.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-5152
The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 6.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-4707
The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialiscontactform shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...
CVE-2024-4608
The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it...
CVE-2024-4458
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2024-4459
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-5152 ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 6.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-5152
CVE-2024-5152 affects the ElementsReady Addons for Elementor plugin (WordPress). It is a Stored Cross-Site Scripting via the _id parameter in all versions up to 6.1.0. Exploitation requires Contributor+ access and can cause scripts to run on pages viewed by users. No remediation details are provi...
CVE-2024-5161
CVE-2024-5161 describes a Stored Cross-Site Scripting vulnerability in the WordPress plugin Magical Addons For Elementor (Header Footer Builder, Free Elementor Widgets, Elementor Templates Library) up to version 1.1.39. The issue arises from insufficient input sanitization and output escaping via...