CVE-2024-2238

CVE-2024-2238 refers to the Premium Addons Pro for WordPress (Elementor) plugin, which is reported as vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to 2.9.12. The issue arises from insufficient input sanitization and output escaping, enabling auth...

CVE-2024-2237 Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-1996

Premium Addons Pro for Elementor (WordPress) is affected by CVE-2024-1996: a stored XSS in the IHover widget link present in versions ≤ 2.9.12 due to insufficient input sanitization and output escaping on user-supplied attributes. This enables authenticated attackers with contributor-level+ permi...

CVE-2024-2237

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-2237

Summary (CVE-2024-2237) The WordPress plugin “Premium Addons PRO” is reported with a Stored Cross‑Site Scripting flaw in the Global Badge module, affecting versions up to and including 2.9.12. The issue arises from insufficient input sanitization and output escaping, enabling an authenticated att...

CVE-2024-2239

CVE-2024-2239 affects WordPress: Premium Addons PRO plugin vulnerable to Stored XSS via the Premium Magic Scroll module. Affected: all versions up to and including 2.9.12. Exploitation requires authenticated access at Contributor level or higher; payload executes when an injected page is loaded. ...

CVE-2024-2239 Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-7015

CVE-2023-7015 concerns the WordPress plugin File Manager Pro. A reflected XSS via the tb parameter exists in all versions up to 8.3.4 due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts in pages executed after user actions (e.g., clicki...

CVE-2023-7015 File Manager Pro <= 8.3.4 - Reflected Cross-Site Scripting

The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-6825 File Manager And File Manager Pro (Multiple Versions) - Directory Traversal

The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 free version and 8.3.4 Pro version via the target parameter in the mkfilefoldermanageractioncallbackshortcode function. This makes it possible for...

CVE-2023-6825

CVE-2023-6825 affects the WordPress File Manager and File Manager Pro plugins. It enables Directory Traversal via the mk_file_folder_manager_action_callback_shortcode target parameter, allowing reading of arbitrary server files and upload to unintended directories. Affected versions: File Manager...

CVE-2024-1691

CVE-2024-1691 – Otter Blocks PRO (WordPress) suffers Stored Cross-Site Scripting via an SVG file upload vector due to insufficient input sanitization and output escaping. Affected: Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO (WordPress). Impact: unauthenticate...

CVE-2023-6954

CVE-2023-6954 affects the WordPress Download Manager Pro plugin up to version 3.2.85. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by insufficient input sanitization and output escaping in the plugin’s shortcode attributes, enabling authenticated attackers with contributor...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Out-of-Bounds Read Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

WordPress Plugin Premium Addons PRO Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-19375 · WordPress · Premium Addons Pro

Name of the Vulnerable Software and Affected Versions: Premium Addons PRO plugin for WordPress versions up to, and including, 2.9.12 Description: The issue is related to Stored Cross-Site Scripting via the Custom Mouse Cursor module due to insufficient input sanitization and output escaping. This...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Buffer Overflow Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

PT-2024-19368 · WordPress · Premium Addons Pro

Name of the Vulnerable Software and Affected Versions: Premium Addons PRO plugin for WordPress versions up to, and including, 2.9.12 Description: The issue is related to Stored Cross-Site Scripting via the Global Badge module due to insufficient input sanitization and output escaping. This allows...

PT-2024-19383 · WordPress · Premium Addons Pro

Name of the Vulnerable Software and Affected Versions: Premium Addons PRO plugin for WordPress versions up to, and including, 2.9.12 Description: The issue is related to Stored Cross-Site Scripting via the Premium Magic Scroll module due to insufficient input sanitization and output escaping. Thi...

PT-2024-18485 · WordPress · Premium Addons Pro

Name of the Vulnerable Software and Affected Versions: Premium Addons PRO plugin for WordPress versions up to, and including, 2.9.12 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the premium fbchat app id parameter o...