WordPress plugin Listdom has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

PT-2024-17295 · WordPress · Listdom

Name of the Vulnerable Software and Affected Versions: Listdom – Business Directory and Classified Ads Listings WordPress Plugin versions up to, and including, 3.7.0 Description: The issue is related to Stored Cross-Site Scripting via the shortcode parameter due to insufficient input sanitization...

PT-2024-16619 · WordPress · Searchiq

Name of the Vulnerable Software and Affected Versions: SearchIQ – The Search Solution plugin for WordPress versions up to, and including, 4.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'siq searchbox' shortcode due to insufficient input sanitization and outp...

CVE-2024-11769: Improper Neutralization of Input During Web Page Generation

The Flower Delivery by Florist One plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flower-delivery' shortcode in all versions up to, and including, 3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2024-17227 · WordPress · Responsive Video

Name of the Vulnerable Software and Affected Versions: Responsive Videos plugin for WordPress versions up to, and including, 2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'somryv' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-11854: Improper Neutralization of Input During Web Page Generation

The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-11903: Improper Neutralization of Input During Web Page Generation

The WP eCards plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ecard' shortcode in all versions up to, and including, 1.3.904 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10952: Improper Control of Generation of Code

The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via updateauthorslistajax AJAX action in all versions up to, and including, 2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running...

PT-2024-17336 · WordPress · Wp Cards

Name of the Vulnerable Software and Affected Versions: WP eCards plugin for WordPress versions up to, and including, 1.3.904 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'ecard' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-11897: Improper Neutralization of Input During Web Page Generation

The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mightyforms' shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress Listdom plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via shortcode Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Listdom versions = 3.7.0...

WordPress Authors List plugin <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax vulnerability

Unauthenticated Arbitrary Shortcode Execution via updateauthorslistajax vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Authors List versions = 2.0.4...

CVE-2024-12062

The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.2 via the 'nacharityelementortemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers...

CVE-2024-12062

The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.3 via the 'nacharityelementortemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers...

CVE-2024-11898

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swin-campaign' shortcode in all versions up to, and including, 2.6.9 due to insufficient input...

PT-2024-17331 · WordPress · Scratch & Win – Giveaways/Contests

Name of the Vulnerable Software and Affected Versions: Scratch & Win – Giveaways and Contests plugin for WordPress versions up to and including 2.6.9 Description: The issue concerns a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping on...

PT-2024-17424

Name of the Vulnerable Software and Affected Versions Charity Addon for Elementor plugin for WordPress versions up to, and including, 1.3.2 Description The issue concerns insufficient restrictions on which posts can be included through the nacharity elementor template shortcode, allowing...

CVE-2024-53736

Cross-Site Request Forgery CSRF vulnerability in Jason Grim Custom Shortcode Sidebars custom-shortcode-sidebars allows Stored XSS.This issue affects Custom Shortcode Sidebars: from n/a through = 1.2...

CVE-2024-53736

The CVE-2024-53736 entry describes a CSRF to Stored XSS vulnerability in WordPress plugin Custom Shortcode Sidebars (versions

CVE-2024-53736 WordPress Custom Shortcode Sidebars plugin <= 1.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jason Grim Custom Shortcode Sidebars custom-shortcode-sidebars allows Stored XSS.This issue affects Custom Shortcode Sidebars: from n/a through = 1.2...