Elementor Website Builder < 3.20.3 - Contributor+ DOM Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Path Widget due to insufficient output escaping on user supplied attributes, allowingnauthenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execut...

PT-2024-11724 · WordPress · Wordpress Countdown Widget

Name of the Vulnerable Software and Affected Versions: WordPress Countdown Widget versions 3.1.9.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Cross-Site Scripting XSS. This means an attacker could potentially trick a user into...

WordPress Plugin Wordpress Countdown Widget 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-52214

Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3...

Gutenberg Blocks by Kadence Blocks < 3.2.26 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its Advanced Form Widget options before outputting them back in a page/post where the widget is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2024-17976 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder Pro plugin for WordPress versions up to, and including, 3.20.1 Description: The issue is related to Stored Cross-Site Scripting via the widget's custom id due to insufficient input sanitization and output escaping on...

PT-2024-18109 · Apache +2 · Apache Http Server +2

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder Pro plugin for WordPress versions up to, and including, 3.20.1 Description: The vulnerability is a Stored Cross-Site Scripting issue that occurs when an SVGZ file is uploaded via the Form widget, due to insufficient...

WordPress Plugin VK All in One Expansion Unit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Elementor Website Builder Pro < 3.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Master Addons for Elementor < 2.0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

Description The Master Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in all versions up to, and including, 2.0.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2024-18865 · WordPress · Master Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Master Addons for Elementor plugin for WordPress versions up to, and including, 2.0.5.6 Description: The issue is related to Stored Cross-Site Scripting via the Pricing Table widget due to insufficient input sanitization and output...

PT-2024-19164 · WordPress · The Plus Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor plugin for WordPress versions up to, and including, 5.4.1 Description: The issue allows authenticated attackers with contributor-level access and above to include and execute arbitrary files on the server via the...

PT-2024-18840 · Elementor · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder versions up to, and including, 3.20.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Post Navigation widget due to insufficient input sanitization and output escaping on user-suppli...

PT-2024-19018 · WordPress · Vk All In One Expansion Unit

Name of the Vulnerable Software and Affected Versions: VK All in One Expansion Unit plugin for WordPress versions up to, and including, 9.96.0.1 Description: The issue is related to Stored Cross-Site Scripting via the child page index widget due to insufficient input sanitization and output...

WordPress Crypto Converter Widget Plugin <= 1.8.4 is vulnerable to Cross Site Scripting (XSS)

Software Crypto Converter Widget Type Plugin Vulnerable versions = 1.8.4 Fixed in 1.9.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29930 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e81cdf7a6290 Credits Yudistira Arya Required...

WordPress Exchange Rates Widget Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Exchange Rates Widget Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29814 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6832d30e4978 Credits Ngô Thiên An ancorn from VNPT-VC...

Super Socializer < 7.13.64 - Editor+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed When creating a new widget, insert the following payload in the "FaceBook URL" field -...

CVE-2024-1049

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on the link value. This makes it possible for...

CVE-2024-2688

The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress document widget in all versions up to, and including, 3.9.12 due to...

CVE-2024-2202

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions up to, and including, 2.29.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...