CVE-2023-0267: Undefined Security Weakness

The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored...

PT-2023-16125 · WordPress · The Ultimate Carousel For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: The Ultimate Carousel For WPBakery Page Builder WordPress plugin versions through 2.6 Description: The issue concerns the failure to validate and escape certain shortcode attributes, which could allow users with the contributor role and above...

PT-2023-16515 · WordPress · Avirato Hotels Online Booking Engine

Name of the Vulnerable Software and Affected Versions: Avirato hotels online booking engine WordPress plugin versions 5.0.5 and earlier Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which are then used in SQL statements. This could allow...

PT-2023-16126 · WordPress · Mega Addons For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: Mega Addons For WPBakery Page Builder WordPress plugin versions prior to 4.3.0 Description: The issue concerns the lack of validation and escaping of certain shortcode attributes, which could allow users with the contributor role and above to...

PT-2023-16342 · WordPress · Wp-D3

Name of the Vulnerable Software and Affected Versions: Wp-D3 WordPress plugin versions prior to 2.4.2 Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the lack of validation and escaping of some shortcode attributes...

CVE-2023-0526: Undefined Security Weakness

The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0537: Undefined Security Weakness

The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

PT-2023-16343 · WordPress · Product Slider For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Product Slider For WooCommerce Lite WordPress plugin versions 1.1.7 and earlier Description: The issue is related to the plugin not validating and escaping some of its shortcode attributes before outputting them back in a page/post where...

PT-2023-16332 · WordPress · The Post Shortcode

Name of the Vulnerable Software and Affected Versions: The Post Shortcode WordPress plugin versions 2.0.9 and earlier Description: The issue concerns a lack of validation and escaping of certain shortcode attributes in the plugin, which could allow users with the contributor role and above to...

CVE-2023-0891

The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0891

The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0891: Improper Neutralization of Input During Web Page Generation

The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

URL Params < 2.5 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC urlparam htmltag='h1' attr='a'...

CVE-2023-0276

The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2023-0418

The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0276: Undefined Security Weakness

The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

PT-2023-16134 · WordPress · Weaver Xtreme Theme Support

Name of the Vulnerable Software and Affected Versions: Weaver Xtreme Theme Support WordPress plugin versions prior to 6.2.7 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which could allow users with the contributor role and above to perform...

CVE-2023-0418: Undefined Security Weakness

The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

File Gallery < 1.8.5.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0367

The Pricing Tables For WPBakery Page Builder formerly Visual Composer WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to...