CVE-2024-10778

CVE-2024-10778 : BuddyPress Builder for Elementor – BuddyBuilder (WordPress plugin) is vulnerable to information exposure in all versions up to 1.7.4 via the shortCode “elementor-template.” The issue arises from insufficient restrictions on which posts can be included, allowing authenticated atta...

CVE-2024-8985: Improper Neutralization of Input During Web Page Generation

The Social Proof Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spslider-block shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2024-39697 · WordPress · Hide Links

Name of the Vulnerable Software and Affected Versions: The Hide Links plugin for WordPress versions up to and including 1.4.2 Description: The issue allows unauthorized shortcode execution due to do shortcode being hooked through the comment text filter. This enables unauthenticated attackers to...

CVE-2024-9578: Missing Authorization

The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to doshortcode being hooked through the commenttext filter in all versions up to and including 1.4.2. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the...

WordPress Hide Links plugin <= 1.4.2 - Unauthenticated Shortcode Execution vulnerability

Unauthenticated Shortcode Execution vulnerability discovered by Francesco Carlucci in WordPress Plugin Hide Links versions = 1.4.2...

CVE-2024-9836

The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Slickstream plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via slick-grid Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Slickstream versions = 1.4.4...

CVE-2024-9836: Improper Neutralization of Input During Web Page Generation

The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Plugin RSS Feed Widget Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-16553 · WordPress · Boostify Header Footer Builder

Name of the Vulnerable Software and Affected Versions: Boostify Header Footer Builder for Elementor plugin for WordPress versions up to, and including, 1.3.6 Description: The issue is related to Information Exposure, where authenticated attackers with Contributor-level access and above can extrac...

CVE-2024-10179: Improper Neutralization of Input During Web Page Generation

The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-16093 · WordPress · Slickstream

Name of the Vulnerable Software and Affected Versions: Slickstream: Engagement and Conversions plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's slick-grid shortcode due to insufficient input sanitization an...

CVE-2024-52352

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Andrew Milo Postcasa Shortcode allows DOM-Based XSS.This issue affects Postcasa Shortcode: from n/a through 1.0...

CVE-2024-52352

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in miloandrew Postcasa Shortcode postcasa allows DOM-Based XSS.This issue affects Postcasa Shortcode: from n/a through = 1.0...

CVE-2024-52352 WordPress Postcasa Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in miloandrew Postcasa Shortcode postcasa allows DOM-Based XSS.This issue affects Postcasa Shortcode: from n/a through = 1.0...

CVE-2024-52352 WordPress Postcasa Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Andrew Milo Postcasa Shortcode allows DOM-Based XSS.This issue affects Postcasa Shortcode: from n/a through 1.0...

CVE-2024-52352

CVE-2024-52352 is a DOM-based Cross-Site Scripting flaw in the WordPress plugin Postcasa Shortcode. The vulnerability affects Postcasa Shortcode versions up to 1.0 and is exploitable in an authenticated context (Contributor+). Descriptions from Red Hat and Wordfence corroborate that the issue ena...

CVE-2024-51573 WordPress ML Responsive Audio plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ersatzpole ML Responsive Audio player with playlist Shortcode mlr-audio allows Stored XSS.This issue affects ML Responsive Audio player with playlist Shortcode: from n/a through = 0.2...

WordPress WP Photo Album Plus plugin <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay vulnerability

Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin WP Photo Album Plus versions = 8.8.08.007...

WordPress plugin Postcasa Shortcode cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...