CVE-2024-2253

Stored XSS in Testimonial Carousel For Elementor (WordPress) across versions

CVE-2024-3063 WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the output of 'tags' added to widgets in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for...

CVE-2024-5223 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-5223

CVE-2024-5223 refers to the Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX for WordPress. It is a Stored Cross-Site Scripting (XSS) vulnerability in the plugin’s file uploading feature, affecting all versions up to and including 4.1.1 due to insufficient input sanitization and outpu...

CVE-2024-3726

CVE-2024-3726 : The WordPress plugin “Login Logout Register Menu” is vulnerable to Stored Cross-Site Scripting via the llrmloginlogout shortcode in all versions up to 2.0 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or...

PT-2024-32108 · WordPress · Gum Elementor Addon

Name of the Vulnerable Software and Affected Versions: Gum Elementor Addon plugin for WordPress versions up to, and including, 1.3.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Price Table and Post Slider widgets. This...

CVE-2024-36427

The file-serving function in TARGIT Decision Suite before 24.06.19002 TARGIT Decision Suite 2024 – June allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file...

CVE-2024-5039

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-5039

CVE-2024-5039 concerns the HUSKY – Products Filter Professional for WooCommerce WordPress plugin. It enables Stored Cross-Site Scripting via shortcode attributes due to insufficient input sanitization and output escaping in versions up to 1.3.5.3. Exploitation requires authenticated access at con...

CVE-2024-3412

CVE-2024-3412 affects the WP STAGING WordPress Backup Plugin – Migration Backup Restore. It is vulnerable in versions

CVE-2024-5086

CVE-2024-5086 affects Essential Addons for Elementor Pro (Team Member Carousel)

CVE-2024-5086 Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget

The Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team Member Carousel widget in all Pro versions up to, and including, 5.8.14 due to insufficient input...

CVE-2023-6743

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated attackers, with contributor access and abov...

CVE-2023-6743 Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated attackers, with contributor access and abov...

Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Remote Content Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'remotecontent' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-36427

The file-serving function in TARGIT Decision Suite before 24.06.19002 TARGIT Decision Suite 2024 – June allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file...

Comparison Slider <= 1.0.5 - Missing Authorization

Description The Comparison Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 1.0.5. This makes it possible for authenticated attackers, with subscriber access or above, to...

CVE-2024-5229

The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5229

CVE-2024-5229 affects the Primary Addon for Elementor plugin (WordPress) through the Pricing Table widget in versions up to and including 1.5.5. The vulnerability is a Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes. Exploit...

CVE-2024-5220

The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access an...