387 matches found
WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Image Widget vulnerability discovered by Francesco Carlucci in WordPress Plugin Ultimate Bootstrap Elements for Elementor versions = 1.4.0...
WordPress Gutenberg plugin 12.9.0-18.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Avatar Block vulnerability discovered by John Blackbourn in WordPress Plugin Gutenberg versions 12.9.0-18.0.0...
PT-2024-23541 · WordPress · Elementor Addons
Name of the Vulnerable Software and Affected Versions: Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress versions up to, and including, 1.4.4.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'Heading'...
CVE-2024-0837
The Element Pack Elementor Addons Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in all versions up to, and including, 5.3.2 due to...
WordPress Beaver Themer plugin <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode vulnerability
Authenticated Contributor+ Sensitive Information Exposure via shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Beaver Themer versions = 1.4.9...
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown and CountUp Widget vulnerability
Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via Countdown and CountUp Widget vulnerability discovered by Webbernaut in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.31...
WordPress TaxoPress plugin <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by stealthcopter in WordPress Plugin TaxoPress versions = 3.12.0...
WordPress Unlimited Elements For Elementor plugin <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Widget Link vulnerability discovered by Webbernaut in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.96...
WordPress WP Chat App plugin <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute vulnerability
AuthenticatedContributor+ Stored Cross-Site Scripting via Block Image Attribute vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin WP Chat App versions = 3.6.2...
CVE-2024-1318
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzywizardstepprocess' and 'importstatus' functions in all versions up to, and...
WordPress Plugin Podlove Subscribe button SQL Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
Sponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, and including, 3.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2023-46640
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in D. Relton Medialist plugin = 1.3.9 versions...
PT-2023-32294 · WordPress · Live Chat With Facebook Messenger
Name of the Vulnerable Software and Affected Versions: Live Chat with Facebook Messenger plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode due to insufficient input sanitization and outpu...
Cross site scripting
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Ciprian Popescu YouTube Playlist Player plugin = 4.6.7 versions...
CVE-2023-27628
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Webvitaly Sitekit plugin = 1.3 versions...
CVE-2023-25981
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in ThemeKraft Post Form plugin = 2.8.1 versions...
CVE-2023-23828
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Swashata WP Category Post List Widget plugin = 2.0.3 versions...