CVE-2024-34566

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johan van der Wijk Content Blocks Custom Post Widget allows Stored XSS.This issue affects Content Blocks Custom Post Widget: from n/a through 3.3.0...

CVE-2024-34566

CVE-2024-34566 is a Stored XSS in Content Blocks (Custom Post Widget) for WordPress. The issue arises from improper input neutralization during web page generation. Affected: Content Blocks (Custom Post Widget)

CVE-2024-34566 WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johan van der Wijk Content Blocks Custom Post Widget allows Stored XSS.This issue affects Content Blocks Custom Post Widget: from n/a through 3.3.0...

WordPress HT Mega plugin <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Tooltip & Popover Widget vulnerability discovered by wesley wcraft in WordPress Plugin HT Mega versions = 2.5.0...

WordPress Advanced Ads plugin <= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Ad Widget vulnerability discovered by wesley wcraft in WordPress Plugin Advanced Ads versions = 1.52.1...

PT-2024-25981 · Unknown · Content Blocks

Name of the Vulnerable Software and Affected Versions: Content Blocks Custom Post Widget versions 3.3.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. There is no...

WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Content Blocks Custom Post Widget versions = 3.3.0...

TweetScroll Widget <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The TweetScroll Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

WordPress Content Blocks (Custom Post Widget) Plugin <= 3.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Content Blocks Custom Post Widget Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34566 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c437cf336c56 Credits Ngô Thiên An ancorn...

Image Hover Effects - Elementor Addon < 1.4.2 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget

Description The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hover Effects Widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-3108

An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device without authorization...

CVE-2024-32831

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lorna Timbah webgrrrl Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2...

CVE-2024-32831 WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lorna Timbah webgrrrl Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2...

CVE-2024-32831 WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lorna Timbah webgrrrl Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2...

CVE-2024-32831

CVE-2024-32831 refers to the WordPress Accessibility Widget plugin (versions n/a through 2.2). The issue is an input handling flaw that allows Stored XSS during web page generation, arising from improper neutralization of input. Affected component is the Accessibility Widget codepath used to rend...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via LaStudioKit Post Author Widget vulnerability discovered by Abu Hurayra in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.3.7.5...

PT-2024-24907 · Unknown · Lorna Timbah (Webgrrrl) Accessibility Widget

Name of the Vulnerable Software and Affected Versions: Lorna Timbah webgrrrl Accessibility Widget versions n/a through 2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

WordPress plugin Accessibility Widget 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Jeg Elementor Kit < 2.6.5 - Contributor+ Stored XSS via Countdown Widget

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

Motorola Time Weather Widget 安全漏洞

Motorola Time Weather Widget is a mobile weather forecasting application from Motorola, Inc. A security vulnerability exists in Motorola Time Weather Widget, which stems from an implicit intent vulnerability that could allow a local application to gain unauthorized access to the device's location...