CVE-2024-50575

In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API...

EUVD-2024-44956

In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API...

CVE-2024-50575

CVE-2024-50575 affects JetBrains YouTrack prior to version 2024.3.47707, where reflected XSS was possible via the Widget API. The vulnerability is documented across multiple feeds (NVD, Red Hat advisory, CNVD, CNVD, and Nessus plugin) as a cross-site scripting issue in the Widget API in YouTrack’...

PT-2024-35510

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bounds checker error in the dapm widget list create function has been resolved. The error occurred because the num widgets variable, which is used for bounds checking, was not set befo...

PT-2024-7636

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2024.3.47707 Description The issue is related to the Widget API component of JetBrains YouTrack, which fails to protect the web page structure. This can lead to reflected XSS attacks, allowing an attacker t...

CVE-2024-50575: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API...

CVE-2024-10091

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10091 ElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-16216

Name of the Vulnerable Software and Affected Versions Clever Addons for Elementor plugin for WordPress versions up to, and including, 2.2.1 Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data...

CVE-2024-10091: Improper Neutralization of Input During Web Page Generation

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-16019 · WordPress · Elementskit Elementor Addons Plugin

Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor addons plugin for WordPress versions up to, and including, 3.2.9 Description: The issue is related to Stored Cross-Site Scripting via the Image Comparison Widget due to insufficient input sanitization and output escaping...

WordPress plugin ElementsKit, Elementor addons – cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-10343 Beek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Beek Widget Extention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10343 Beek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Beek Widget Extention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

PT-2024-16203 · WordPress · Beek Widget Extention

Name of the Vulnerable Software and Affected Versions: Beek Widget Extention plugin for WordPress versions up to, and including, 0.9.5 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

CVE-2024-10343: Improper Neutralization of Input During Web Page Generation

The Beek Widget Extention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

WordPress plugin Beek Widget Extension has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Beek Widget Extention plugin <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by István Márton in WordPress Plugin Beek Widget Extention versions = 0.9.5...

WordPress Beek Widget Extention Plugin <= 0.9.5 is vulnerable to Cross Site Scripting (XSS)

Software Beek Widget Extention Type Plugin Vulnerable versions = 0.9.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10343 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b42322ec0960 Credits István Márton...

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget

Cross-site request forgery CSRF vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to 1 change us...