HT Mega < 2.4.9 - Contributor+ Stored XSS via Accordion/FAQ

Description The plugin is vulnerable to Stored Cross-Site Scripting via Accordion widget due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web...

HT Mega < 2.5.0 - Contributor+ Stored XSS via Countdown Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the Countdown widget's attributes due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that...

WordPress Navigation menu as dropdown Widget plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Navigation menu as Dropdown Widget versions = 1.3.4...

WordPress Navigation menu as Dropdown Widget Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Navigation menu as Dropdown Widget Type Plugin Vulnerable versions = 1.3.4 Fixed in 1.3.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32126 Patch priority Low CVSS severity Low 5.9 Developer Jeroen Peters PSID 5c32e593787a Credits Joshua Chan Required...

Shortcodes and extra features for Phlox theme <= 2.15.5 - Contributor+ Stored XSS via Accordion Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the Accordion Widget due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execu...

CVE-2023-47123 iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget

iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0...

CVE-2023-47123 iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget

iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0...

WordPress WPZOOM Social Feed Widget & Block plugin <= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Instagram Image Deletion vulnerability discovered by Thura Moe Myint mgthuramoemyint in WordPress Plugin WPZOOM Social Feed Widget & Block versions = 2.1.13...

PT-2024-3146 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.4 Description: The issue is related to insufficient input sanitization and output escaping on user-supplied attributes in the JKit - Banner widget, allowing authenticat...

WordPress Language Translate Widget for WordPress – ConveyThis Plugin <= 223 is vulnerable to Cross Site Scripting (XSS)

Software Language Translate Widget for WordPress – ConveyThis Type Plugin Vulnerable versions = 223 Fixed in 224 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6811 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

CVE-2024-3662

CVE-2024-3662 affects the WPZOOM Social Feed Widget & Block plugin for WordPress. The vulnerability is due to a missing capability check in the function wpzoom_instagram_clear_data(), present in all versions up to and including 2.1.13. This allows authenticated attackers with subscriber-level acc...

WordPress Plugin WPZOOM Social Feed Widget & Block 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Image Widget vulnerability discovered by Francesco Carlucci in WordPress Plugin Ultimate Bootstrap Elements for Elementor versions = 1.4.0...

WordPress Element Pack Elementor Addons plugin <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Trailer Box Widget vulnerability discovered by Nikolas in WordPress Plugin Element Pack Elementor Addons versions = 5.5.3...

CVE-2024-2539

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget 'id' attributes in all versions up to, and including, 8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-2666

The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-2664

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2664 Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Plugin Elementor Addons by Livemesh 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress Plugin...

PT-2024-20914 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.3.6 Description: The issue is related to Stored Cross-Site Scripting via widget id attributes due to insufficient input sanitization and output escaping on...