WordPress Scratch & Win – Giveaways and Contests plugin <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Scratch & Win – Giveaways and Contests versions = 2.6.9...

WordPress Royal Elementor Addons and Templates plugin <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Royal Elementor Addons versions = 1.7.1003...

WordPress Login with Vipps and MobilePay plugin <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Login with Vipps and MobilePay versions = 1.3.3...

WordPress File Manager Pro – Filester plugin <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin File Manager Pro versions = 1.8.4...

Drupal Tarte au Citron module 2.0.0-2.0.4 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff in WordPress Module Tarte au Citron versions 2.0.0-2.0.4...

CVE-2024-10308 Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Attesa Extra plugin <= 1.4.2 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Attesa Extra versions = 1.4.2...

WordPress NiceJob plugin <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin NiceJob versions = 3.7.1...

WordPress Beds24 Online Booking plugin <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via beds24-link Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Beds24 Online Booking versions = 2.0.27...

Korenix JetNet Authenticated Command Injection (CVE-2020-12503)

Improper Authorization vulnerability of Korenix JetNet 5428G-20SFP, JetNet 5810G, JetNet 4706F, JetNet 4510, JetNet 5310, JetNet 4706, JetNet 5428G, JetNet 6095, JetNet 4706 are prone to multiple authenticated command injections. This plugin only works with Tenable.ot. Please visit...

WordPress Support SVG <= 1.1.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Support SVG versions = 1.1.0...

WordPress Booking & Appointment Plugin for WooCommerce plugin <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update vulnerability

Authenticated Subscriber+ Arbitrary Option Update vulnerability discovered by István Márton in WordPress Plugin Booking & Appointment Plugin for WooCommerce versions = 6.9.0...

WordPress Rescue Shortcodes plugin <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via rescueprogressbar Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Rescue Shortcodes versions = 2.9...

WordPress Memberlite Shortcodes plugin <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite_accordion Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via memberliteaccordion Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Memberlite Shortcodes versions = 1.3.9...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by WordFence in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.4.2...

WordPress Slick Sitemap plugin <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Slick Sitemap versions = 2.0.0...

WordPress Pure CSS Circle Progress bar plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Pure CSS Circle Progress Bar versions = 1.2...

WordPress If-So Dynamic Content Personalization plugin <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin If-So Dynamic Content Personalization versions = 1.9.2.1...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.3.3...

WordPress Theme Builder For Elementor plugin <= 1.2.2 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Theme Builder For Elementor versions = 1.2.2...