PT-2025-3857 · WordPress · Jetelements

Name of the Vulnerable Software and Affected Versions: JetElements plugin for WordPress versions up to, and including, 2.7.2.1 Description: The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets due to insufficient input sanitization and output...

CVE-2025-22569

The CVE-2025-22569 entry concerns a Reflected Cross-Site Scripting (XSS) in the Featured Page Widget for WordPress (plugin). The description indicates improper neutralization of input during web page generation, enabling a reflected XSS vulnerability. Affected scope is listed as Featured Page Wid...

CVE-2024-13153

CVE-2024-13153 affects the Unlimited Elements For Elementor plugin for WordPress. It enables Stored XSS via multiple widgets (Image Tooltip, Notification, Simple Popup, Video Play Button, Card Carousel) in all versions up to 1.5.135 due to insufficient input sanitization/escaped output on user at...

CVE-2024-52047

A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...

CVE-2023-23823 WordPress Enhanced Text Widget plugin <= 1.5.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.5.8...

WordPress Prime Slider - Addons For Elementor plugin <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget vulnerability

WordPress Prime Slider - Addons For Elementor plugin = 3.15.18 - Authenticated Contributor+ Stored Cross-Site Scripting via Blog Widget vulnerability discovered by Robert DeVore in WordPress Plugin Prime Slider – Addons For Elementor versions = 3.15.18...

CVE-2024-49685 WordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Syed Balkhi Custom Twitter Feeds Tweets Widget custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds Tweets Widget: from n/a through = 2.2.3...

WordPress plugin Most And Least Read Posts Widget 跨站请求伪造漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in WordPress plugin Most And Least...

PT-2024-33375 · Unknown · Adif Log Search Widget

Name of the Vulnerable Software and Affected Versions: ADIF Log Search Widget versions 1.0f and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Reflected XSS in the ADIF Log Search Widget...

WordPress SB Random Posts Widget plugin <= 1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin SB Random Posts Widget versions = 1.0...

CVE-2024-47817 Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes for the lara-zeus ecosystem. If values passed to a paragraph widget are not valid and contain a specific set of characters, applications a...

CVE-2024-47817 Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes for the lara-zeus ecosystem. If values passed to a paragraph widget are not valid and contain a specific set of characters, applications a...

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets vulnerability discovered by Webbernaut in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.16.3...

WordPress Logo Manager For Enamad plugin <= 0.7.1 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Bob Matyas in WordPress Plugin Logo Manager For Enamad versions = 0.7.1...

WordPress Piotnet Addons For Elementor plugin <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by Webbernaut in WordPress Plugin Piotnet Addons For Elementor versions = 2.4.30...

CVE-2024-42616

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/adminwidgets.php?action=remove&widget=Statistics...

CVE-2024-37548

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8...

CVE-2024-37958

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Meks Meks Smart Author Widget allows Stored XSS.This issue affects Meks Smart Author Widget: from n/a through 1.1.4...

PT-2024-27863 · Unknown · Meks Smart Author Widget

Name of the Vulnerable Software and Affected Versions: Meks Smart Author Widget versions 1.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

CVE-2024-4866

The UltraAddons – Elementor Addons Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.1.6 due to insufficient input...