CVE-2024-13699

CVE-2024-13699 affects the Qi Addons For Elementor WordPress plugin. It is a Stored Cross-Site Scripting vulnerability via the cursor parameter in all versions up to 1.8.7, enabling an authenticated attacker (Contributor level or higher) to inject scripts that execute when a user loads a page. Ro...

CVE-2024-13699 Qi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2024-13733

The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/post-carousel block in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-12597 HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockcss' and 'innercss' parameters in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2024-12597

CVE-2024-12597 (HT Mega – Absolute Addons For Elementor for WordPress) is a stored XSS vulnerability in the block_css and inner_css parameters, present in all versions up to 2.7.6. The issue requires authenticated access at Contributor level or higher and can cause arbitrary scripts to execute wh...

CVE-2024-13332

The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13115

The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

MAL-2025-889 Malicious code in x509-escaping (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in x509-escaping (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-13347 Essential WP Real Estate <= 1.1.3 - Reflected XSS

The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

Cross-Site Scripting (XSS)

twig/twig is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of output escaping for the expression on the left side of the ?? operator in Twig, which allowed unsanitized data to be rendered in the output...

CVE-2024-11829

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Widget's searchablelabel parameter in all versions up to, and including, 6.1.8 due to insufficient input sanitizati...

CVE-2024-13099

The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-11780

CVE-2024-11780 : Site Search 360 for WordPress is affected by a Stored Cross‑Site Scripting vulnerability in all versions up to 2.1.6 via the ss360-resultblock shortcode, caused by insufficient input sanitization and output escaping. Exploitation requires authentication at contributor level or hi...

CVE-2024-13547 aThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-13547 aThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress plugin WP Finance 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-53319

A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service DoS via escaping special XML characters...

CVE-2024-53319

A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service DoS via escaping special XML characters...

CVE-2024-13662

CVE-2024-13662 describes an authenticated Stored Cross-Site Scripting vulnerability in the WordPress plugin eHive Objects Image Grid (versions up to and including 2.4.1). The issue arises from insufficient input sanitization and output escaping in the shortcode ehive_objects_image_grid , allowing...