7141 matches found
CVE-2024-37247
CVE-2024-37247 refers to a stored XSS in the WordPress plugin jQuery T(-) Countdown Widget (versions <= 2.3.25). The root cause is improper input neutralization during page generation in the plugin, enabling cross-site scripting when processing user-supplied data. Affected product: WordPress p...
WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.2.42 - Contributor+ Stored Cross-Site Scripting in Google Maps Widget vulnerability
Contributor+ Stored Cross-Site Scripting in Google Maps Widget vulnerability discovered by wesley wcraft in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.42...
WordPress Video Widget plugin <= 1.2.3 - Admin+ Stored XSS via Widget vulnerability
Admin+ Stored XSS via Widget vulnerability discovered by Bob Matyas in WordPress Plugin Video Widget versions = 1.2.3...
CVE-2024-5215
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress Exclusive Addons for Elementor plugin <= 2.6.9.8 - Contributor+ Stored Cross-Site Scripting via Card Widget vulnerability
Contributor+ Stored Cross-Site Scripting via Card Widget vulnerability discovered by wesley wcraft in WordPress Plugin Exclusive Addons Elementor versions = 2.6.9.8...
CVE-2024-5169
The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-5332
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-5332
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-5169
The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-5169 Video Widget <= 1.2.3 - Admin+ Stored XSS via Widget
The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-5169
CVE-2024-5169 affects the Video Widget WordPress plugin (versions ≤ 1.2.3). The vulnerability arises from insufficient sanitisation/escaping of widget settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Public‑facing advi...
CVE-2024-5173
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-5173
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-5173
The HT Mega – Absolute Addons For Elementor WordPress plugin (versions ≤ 2.5.5) is vulnerable to stored XSS via the Video Player widget settings due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contributor level or higher, enabling injectio...
PT-2024-34836 · WordPress · Video Widget
Name of the Vulnerable Software and Affected Versions: Video Widget WordPress plugin versions 1.2.3 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...
WordPress Video Widget Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)
Software Video Widget Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5169 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 23642e80fedc Credits Bob Matyas Required privilege...
WordPress plugin jQuery T(-) Countdown Widget Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...
WordPress Plugin Video Widget Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...
CVE-2024-5451
The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Icon and Heading widgets in all versions up to, and including, 11.13.0 due to insufficient input sanitization and output escaping on...
