CVE-2024-5224

CVE-2024-5224 affects the WordPress plugin “Easy Social Like Box – Popup – Sidebar Widget.” Connected sources confirm a Stored Cross-Site Scripting flaw in the plugin’s shortcode cardoza_facebook_like_box on all versions up to and including 4.0, caused by insufficient input sanitization and outpu...

CVE-2024-5001

The WordPress plugin Image Hover Effects for Elementor with Lightbox and Flipbox (up to version 3.0.2) is affected by a Stored Cross-Site Scripting vulnerability. The root cause is insufficient input sanitization and output escaping in the parameters _id, oxi_addons_f_title_tag, and content_descr...

CVE-2024-5001 Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters

The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id', 'oxiaddonsftitletag', and 'contentdescriptiontag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and outpu...

CVE-2023-6956 EasyAzon – Amazon Associates Affiliate Plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale

The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-cloaking-locale’ parameter in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-6956

CVE-2023-6956 concerns the EasyAzon – Amazon Associates Affiliate Plugin for WordPress. The vulnerability is a Reflected XSS in the easyazon-cloaking-locale parameter affecting all versions up to and including 5.1.0, caused by insufficient input sanitization and output escaping. This enables unau...

CVE-2024-4942 Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2024-4942 Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2024-4942

CVE-2024-4942 concerns the WordPress Custom Dash plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via admin settings in all versions up to and including 1.0.2. It requires an authenticated attacker with administrator-level permissions and above. The issue affects multisite install...

CVE-2024-5342 Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sipspopup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5342

The CVE-2024-5342 entry concerns the WordPress plugin Simple Image Popup Shortcode. It states a Stored XSS vulnerability in the sips_popup shortcode across all versions up to and including 1.0, caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation...

CVE-2024-5342 Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sipspopup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin Image Hover Effects for Elementor with Lightbox and Flipbox security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Qi Addons For Elementor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress plugin MultiVendorX Marketplace - WooCommerce MultiVendor Marketplace Solution Security Vulnerability

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin MultiVendorX Marketplace - WooCommerce MultiVendor...

WordPress plugin Themesflat Addons For Elementor Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks < 2.2.81 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute

Description The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficien...

PT-2024-34169 · WordPress · Colibri Page Builder

Name of the Vulnerable Software and Affected Versions: Colibri Page Builder plugin for WordPress versions up to, and including, 1.0.276 Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input...

PT-2024-18289 · WordPress · Clever Fox

Name of the Vulnerable Software and Affected Versions: The Clever Fox plugin for WordPress version 25.2.0 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's info box block due to insufficient input sanitization and output escaping on user-supplied...

WordPress plugin Colibri Page Builder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Simple Image Popup Shortcode security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...