CVE-2024-10797: Authorization Bypass Through User-Controlled Key

The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen Menu Elementor Widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers,...

PT-2024-17666 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.16.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Staff widget due to insufficient input sanitization and...

CVE-2024-12588: Improper Neutralization of Input During Web Page Generation

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress plugin Shortcodes and additional features for Phlox theme – Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

CVE-2024-56357

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the "javascript:" scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3....

CVE-2024-56357: Improper Neutralization of Input During Web Page Generation

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the javascript: scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3.1...

PT-2024-36799 · Unknown · Grist-Core

Name of the Vulnerable Software and Affected Versions: grist-core versions prior to 1.3.1 Description: A user visiting a malicious document or submitting a malicious form could have their account compromised due to the ability to use the javascript: scheme with custom widget URLs and form redirec...

WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Widget Options versions = 4.0.6.1...

CVE-2024-49576

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBFWidget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An...

CVE-2024-49576

Foxit Reader 2024.3.0.26795 contains a use-after-free in handling the checkbox CBF_Widget object. A crafted PDF with JavaScript can trigger memory corruption and arbitrary code execution. Exploitation requires user interaction (opening the malicious file or visiting a malicious site if the browse...

CVE-2024-12340

CVE-2024-12340 affects the Animation Addons for Elementor WordPress plugin. The vulnerability is a Sensitive Information Exposure via the render function in widgets/content-slider.php and widgets/tabs.php, allowing authenticated attackers with Contributor+ privileges to extract private, pending, ...

PT-2024-9691 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2024.3.0.26795 Description: A use-after-free vulnerability exists in the way Foxit Reader handles a checkbox CBF Widget object. This vulnerability can be triggered by a specially crafted Javascript code inside a malicious...

WordPress Animation Addons for Elementor plugin <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template vulnerability

Authenticated Contributor+ Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template vulnerability discovered by Ankit Patel in WordPress Plugin Animation Addons for Elementor versions = 1.1.6...

WordPress Custom Dashboard Widget plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Custom Dashboard Widget versions = 1.0.0...

CVE-2024-54433

Cross-Site Request Forgery CSRF vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through = 1.1...

CVE-2024-54433 WordPress Simple Booking – Widget plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through = 1.1...

CVE-2024-54433 WordPress Simple Booking – Widget plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Simple Booking Simple Booking Widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through 1.1...

CVE-2024-54433

CVE-2024-54433 describes a CSRF vulnerability in the Simple Booking Widget that can lead to stored XSS. Affected software is Simple Booking Widget (version range from n/a through 1.1). Connected sources confirm the issue and indicate patch status as Unpatched; no public exploitation status is pro...

CVE-2024-54433: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through = 1.1...

WordPress plugin Simple Booking Widget has a vulnerability related to cross-site request forgeing.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...