CVE-2024-11761 LegalWeb Cloud <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The LegalWeb Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'legalweb-popup' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress EmbedPress plugin <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'providername' vulnerability discovered by Max Boll b0lli in WordPress Plugin EmbedPress versions = 4.1.3...

CVE-2024-11119 BNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode

The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11119 BNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode

The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress 워드프레스 결제 심플페이 plugin <= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw_instant_payment Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting pafwinstantpayment Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin 워드프레스 결제 심플페이 versions = 5.1.4...

CVE-2024-11385

CVE-2024-11385 affects the WordPress plugin Pure CSS Circle Progress bar (versions ≤ 1.2). The issue is a Stored Cross-Site Scripting vulnerability in the circle_progress shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires at lea...

WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via sonaaraudioplayer Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.8...

WordPress Mapster WP Maps plugin <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Akbar Kustirama in WordPress Plugin Mapster WP Maps versions = 1.6.0...

WordPress Easy Pricing Tables plugin <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Easy Pricing Tables versions = 3.2.6...

WordPress WP Simple Anchors Links plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpanchor Shortcode vulnerability discovered by theviper17y in WordPress Plugin WP Simple Anchors Links versions = 1.0.0...

CVE-2024-9886 WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Baidu Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'baidumap' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10055 Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode

The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaiosnapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-9703 Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

WordPress Sina Extension for Elementor plugin <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template vulnerability

Authenticated Contributor+ Sensitive Information Exposure via Sina Modal Box Widget Elementor Template vulnerability discovered by Nishiv in WordPress Plugin Sina Extension for Elementor versions = 3.5.7...

WordPress Elementor plugin <= 3.24.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt function vulnerability

Authenticated Contributor+ Basic Information Exposure via getimagealt function vulnerability discovered by stealthcopter in WordPress Plugin Elementor Website Builder versions = 3.24.5...

WordPress Social Sharing (by Danny) plugin <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Social Sharing by Danny versions = 1.3.7...

CVE-2024-9704 Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Social Sharing by Danny plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvksocialsharing' shortcode in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

WordPress The Plus Addons for Elementor plugin <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure

Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Ankit Patel in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 5.6.11...

WordPress XO Slider plugin <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin XO Slider versions = 3.8.6...

WordPress Geo Mashup plugin <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via geomashupvisiblepostslist Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Geo Mashup versions = 1.13.13...