CVE-2024-11750: Improper Neutralization of Input During Web Page Generation

The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11384: Improper Neutralization of Input During Web Page Generation

The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

PT-2024-16986 · WordPress · Sql Chart Builder

Name of the Vulnerable Software and Affected Versions: SQL Chart Builder plugin for WordPress versions up to, and including, 2.3.6 Description: The issue arises from insufficient escaping on the user-supplied arg1 parameter and lack of sufficient preparation on the existing SQL query in the gvn...

PT-2024-17242

Name of the Vulnerable Software and Affected Versions WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress versions up to, and including, 1.3.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'gs book showcas...

CVE-2024-10910: Improper Control of Generation of Code

The The Grid Plus – Unlimited grid layout plugin for WordPress is vulnerable to arbitrary shortcode execution via gridplusloadbycategory AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2024-11433: Improper Neutralization of Input During Web Page Generation

The Surbma | SalesAutopilot Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sa-form' shortcode in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-17334 · WordPress · Powerbi Embed Reports

Name of the Vulnerable Software and Affected Versions: PowerBI Embed Reports plugin for WordPress versions up to, and including, 1.1.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'MO API POWER BI' shortcode due to insufficient input sanitization and output...

PT-2024-17415 · WordPress · Carousel Slider & Grid Ultimate

Name of the Vulnerable Software and Affected Versions: Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress versions up to, and including, 1.9.10 Description: The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary...

PT-2024-17604 · WordPress · Wp-Revive Adserver

Name of the Vulnerable Software and Affected Versions: WP-Revive Adserver plugin for WordPress versions up to, and including, 2.2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wprevive async shortcode due to insufficient input sanitization and output escaping...

CVE-2024-11781: Improper Neutralization of Input During Web Page Generation

The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

PT-2024-17311 · WordPress · Add Infos To The Events Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Add infos to the events calendar plugin for WordPress versions up to, and including, 1.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'fuss' shortcode due to insufficient input sanitization and output...

CVE-2024-12018: Missing Authorization

The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, wit...

CVE-2024-11760: Improper Neutralization of Input During Web Page Generation

The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-11442: Improper Neutralization of Input During Web Page Generation

The Horizontal scroll image slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'horizontal-scroll-image-slideshow' shortcode in all versions up to, and including, 10.1 due to insufficient input sanitization and output escaping on user supplied attributes...

PT-2024-16996 · WordPress · Horizontal Scroll Image Slideshow

Name of the Vulnerable Software and Affected Versions: Horizontal scroll image slideshow plugin for WordPress versions up to and including 10.1 Description: The issue is related to stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes i...

CVE-2024-11871: Improper Neutralization of Input During Web Page Generation

The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'patreon' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11875: Improper Neutralization of Input During Web Page Generation

The Add infos to the events calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fuss' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-17548 · WordPress · Woodmart

Name of the Vulnerable Software and Affected Versions: Woodmart theme for WordPress versions up to 8.0.3 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software permitting users to execute an action without properly validating a value before...

PT-2024-17319 · WordPress · Faq/Answers – Create Frequently Asked Questions Area

Name of the Vulnerable Software and Affected Versions: FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'faq' shortcode due to insufficie...

CVE-2024-11882: Improper Neutralization of Input During Web Page Generation

The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'faq' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied...