PT-2024-39442 · WordPress · Common Tools For Site

Name of the Vulnerable Software and Affected Versions: Common Tools for Site plugin for WordPress versions up to, and including, 1.0.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

PT-2024-39471 · WordPress · Gf Custom Style

Name of the Vulnerable Software and Affected Versions: GF Custom Style plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticate...

CVE-2024-9069

The Graphicsly – The ultimate graphics plugin for WordPress website builder Gutenberg, Elementor, Beaver Builder, WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and...

CVE-2024-9073

The GutenGeek Free Gutenberg Blocks for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-8917

The AnWP Football Leagues plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.16.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access an...

PT-2024-39407 · WordPress · Gutengeek Free Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: GutenGeek Free Gutenberg Blocks for WordPress plugin versions up to, and including, 1.1.3 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

PT-2024-39404 · WordPress · Graphicsly

Name of the Vulnerable Software and Affected Versions: The Graphicsly plugin for WordPress versions up to, and including, 1.0.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2024-39318 · WordPress · Anwp Football Leagues

Name of the Vulnerable Software and Affected Versions: AnWP Football Leagues plugin for WordPress versions up to, and including, 0.16.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

CVE-2024-5567

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, t...

CVE-2024-5567

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, t...

WordPress plugin Betheme 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-36577 · WordPress · Betheme Theme For Wordpress

Name of the Vulnerable Software and Affected Versions: BetheME theme for WordPress versions up to, and including, 27.5.5 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2024-6849

The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2024-37903 · WordPress · The Preloader Plus

Name of the Vulnerable Software and Affected Versions: The Preloader Plus – WordPress Loading Screen Plugin versions up to, and including, 2.2.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

CVE-2024-43801 Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin

Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin Web UI e.g. via "view image" in a...

CVE-2024-7304

The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-6804

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

WordPress Jeg Elementor Kit plugin <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File vulnerability discovered by wesley wcraft in WordPress Plugin Jeg Elementor Kit versions = 2.6.7...

WordPress plugin Jeg Elementor Kit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-38772 · WordPress · The Logo Showcase Ultimate

Name of the Vulnerable Software and Affected Versions: The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress versions up to, and including, 1.4.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...