CVE-2024-0445

CVE-2024-0445 concerns WordPress plugin The Plus Addons for Elementor Page Builder. Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to 5.4.2, caused by insufficient input sanitization and output escaping in the plugin’s element attributes. Exploitati...

CVE-2024-3923

Technical details about CVE-2024-3923 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories to obtain affected versions, impact, and fixes.

CVE-2024-3990

CVE-2024-3990 applies to HT Mega – Absolute Addons For Elementor for WordPress. It is a Stored Cross-Site Scripting vulnerability in the Tooltip & Popover Widget present in all versions up to and including 2.5.0, caused by insufficient input sanitization and output escaping on user-supplied attri...

CVE-2024-3990 HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-4542

CVE-2024-4542 is rejected and not used; please refer to CVE-2024-3548 instead.

CVE-2024-4339

CVE-2024-4339 is a Stored Cross-Site Scripting vulnerability in the Prime Slider – Addons For Elementor plugin (bdthemes-prime-slider-lite) for WordPress. The issue affects all versions up to 3.14.3 and is caused by insufficient input sanitization and output escaping in the General widget, allowi...

CVE-2024-4446

CVE-2024-4446 affects Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) for WordPress. The underlying issue is insufficient input sanitization and output escaping in the pagingType parameter, leading to a Stored Cross-Site Scripting opportun...

CVE-2024-3831

CVE-2024-3831 (Enter Addons – Ultimate Template Builder for Elementor) : The WordPress plugin is vulnerable to a Stored Cross-Site Scripting (XSS) in the Heading widget across all versions up to 2.1.5 due to insufficient input sanitization and output escaping. Exploitation requires authentication...

CVE-2024-3722

The CVE-2024-3722 entry concerns the Swift Performance Lite WordPress plugin. It describes an unauthorized access vulnerability caused by a missing capability check in ajax_handler(), affecting all versions up to and including 2.3.6.18. The issue can be exploited by authenticated attackers with s...

CVE-2024-3722 Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification

The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajaxhandler function in all versions up to, and including, 2.3.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to retriev...

CVE-2024-3595

CVE-2024-3595 affects the Pure Chat – Live Chat & More! WordPress plugin up to version 2.22. It is vulnerable to Stored Cross-Site Scripting via the purechatwid and purechatwname parameters due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (sub...

CVE-2024-3916

CVE-2024-3916 concerns the Swift Framework WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in several plugin shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. It affects all versions up to and including 2.7.31. The impact...

CVE-2024-3952 Advanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all versions up to, and including, 1.52.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4383

CVE-2024-4383 affects the WordPress plugin Simple Membership. The vulnerability is a Stored Cross-Site Scripting via the plugin’s swpm_paypal_subscription_cancel_link shortcode in all versions up to and including 4.4.5, caused by insufficient input sanitization and output escaping on user-supplie...

CVE-2024-1166

CVE-2024-1166 corresponds to the Image Hover Effects – Elementor Addon for WordPress. The vulnerability is a Stored Cross-Site Scripting in the Image Hover Effects Widget due to insufficient input sanitization and output escaping. Affected versions are all up to 1.4.1. Exploitation requires authe...

CVE-2024-3807 Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'portopageheadershortcodetype', 'slideshowtype' and 'postlayout' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to...

CVE-2024-4386

CVE-2024-4386 affects the Gallery Block (Meow Gallery) WordPress plugin. The vulnerability is a Stored XSS via the data_atts parameter in versions up to 5.1.3, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher,...

CVE-2024-3680 Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's img tag in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-4158

CVE-2024-4158: Blocksy Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the tagName parameter in Blocksy versions up to 2.0.42 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher; successful inje...

CVE-2024-1693 SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdmsavecategory AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level acce...