CVE-2024-1957

CVE-2024-1957 concerns GiveWP – Donation Plugin and Fundraising Platform for WordPress. It is a stored cross-site scripting (XSS) vulnerability in the plugin’s shortcodes, specifically via the ‘give_form’ shortcode in all versions up to and including 3.6.1, caused by insufficient input sanitizati...

CVE-2024-2327

The Global Elementor Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link URL in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2289

The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link in multiple elements in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2039

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Postv2 block title tag in all versions up to, and including, 3.12.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

CVE-2024-0873

The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-2311 Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-1498 Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Photo Stack Widget in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-1498

CVE-2024-1498 (Happy Addons for Elementor) is a Stored Cross-Site Scripting vulnerability in the Photo Stack Widget affecting all versions up to 3.10.3. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers with cont...

CVE-2024-2039

The vulnerability CVE-2024-2039 affects Stackable – Page Builder Gutenberg Blocks for WordPress. All versions up to 3.12.11 are susceptible to stored XSS via the Post(v2) block title tag due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires ...

CVE-2024-0873

CVE-2024-0873: Watu Quiz (WordPress) is vulnerable to Stored Cross-Site Scripting via the watu-basic-chart shortcode on versions up to 3.4.1. Authenticated users with contributor+ privileges can inject scripts that run when other users load the page. The Wordfence entry notes a patch is available...

CVE-2024-2287 Knight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

The Knight Lab Timeline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.9.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2305 Cards for Beaver Builder <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link

The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BootstrapCard link in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-6993 Custom post types, Custom Fields & more <= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping on user supplied post meta values...

CVE-2023-6993

CVE-2023-6993 affects the WordPress plugin Custom post types, Custom Fields & more. It enables Stored XSS via the plugin shortcode and user-supplied post meta in versions up to 5.0.4 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (contributo...

CVE-2024-0376

CVE-2024-0376 affects the Premium Addons for Elementor plugin on WordPress. It enables Stored Cross-Site Scripting via the Wrapper Link Widget in all versions up to 4.10.16 due to insufficient input sanitization and output escaping of user‑provided URLs. Exploitation requires at least Contributor...

CVE-2024-29834

Apache Pulsar CVE-2024-29834 allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics (unload/compact) and to read/create/modify/delete namespace properties across namespaces; impact assumes default authorization provider. Affected: 2...

CVE-2024-1051 List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'titletag'. This makes it possibl...

CVE-2024-1051

The CVE-2024-1051 issue affects the List category posts WordPress plugin, where the catlist shortcode is vulnerable to Stored XSS in all versions up to 0.89.6 due to insufficient input sanitization and output escaping. The vulnerability requires authenticated access (contributor-level and above) ...

CVE-2024-1692

The CVE-2024-1692 entry concerns BoldGrid Easy SEO – Simple and Effective SEO for WordPress. The vulnerability is Stored Cross-Site Scripting via the meta description field in all versions up to 1.6.13, caused by insufficient input sanitization and output escaping on user-supplied attributes. The...

Kimai API returns timesheet entries a user should not be authorized to view

Summary The permission viewothertimesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. Details When setting the viewothertimesheet permission to true, on the frontend, users can only see timesheet entries for teams they are a part of. When...