MAL-2024-7094 Malicious code in auth0-dashboard-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd3d9dcd233e8f88bec84813744dcf3ea68a677d4025fd66d55d2f1190be1b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-4482

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping...

CVE-2024-6340 Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress BLAZE Retail Widget plugin <= 2.5.2 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin BLAZE Retail Widget versions = 2.5.2...

WordPress The Plus Addons for Elementor plugin <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Countdown Widget vulnerability discovered by wesley wcraft in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 5.6.1...

WordPress Premium Addons for Elementor plugin <= 4.10.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Countdown Widget vulnerability discovered by Webbernaut in WordPress Plugin Premium Addons for Elementor versions = 4.10.35...

WordPress BLAZE Retail Widget Plugin <= 2.5.2 is vulnerable to Backdoor

Software BLAZE Retail Widget Type Plugin Vulnerable versions = 2.5.2 Fixed in 2.5.4 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a9f87b35d94a Credits Sansec.io Required privilege Unauthenticated Published 3 July...

PT-2024-37552 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.35 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Countdown widget due to insufficient input sanitization and output...

CVE-2024-6340: Improper Neutralization of Input During Web Page Generation

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4482: Improper Neutralization of Input During Web Page Generation

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping...

PT-2024-31267

Name of the Vulnerable Software and Affected Versions The Plus Addons for Elementor versions up to, and including, 5.6.1 Description The issue is related to Stored Cross-Site Scripting via the 'Countdown' widget due to insufficient input sanitization and output escaping on the user-supplied text...

CVE-2024-37479

Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "progresstype" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1...

CVE-2024-5504

CVE-2024-5504 affects the Rife Elementor Extensions & Templates plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting flaw in the Writing Effect Headline widget via the tag attribute, exploited by authenticated attackers with contributor-level access and above, due to insuffici...

CVE-2024-5419

The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7redirectpage' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and outpu...

WordPress Rife Elementor Extensions & Templates plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Writing Effect Headline Widget vulnerability discovered by wesley wcraft in WordPress Plugin Rife Elementor Extensions & Templates versions = 1.2.1...

CVE-2024-5504: Improper Neutralization of Input During Web Page Generation

The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within the plugin's Writing Effect Headline widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user...

PT-2024-36080

Name of the Vulnerable Software and Affected Versions: The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress versions up to, and including, 2.4 Description: The issue is related to Stored Cross-Site Scripting via the cf7 redirect page attribute within the plugin's Void...

CVE-2024-5419: Improper Neutralization of Input During Web Page Generation

The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7redirectpage' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and outpu...

WordPress Happy Addons for Elementor plugin <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Gradient Heading Widget vulnerability discovered by wesley wcraft in WordPress Plugin Happy Addons for Elementor versions = 3.11.1...

CVE-2024-6415 Ingenico Estate Manager New Widget cross site scripting

A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /emgui/rest/preferences/PREFHOMEPAGE/sponsor/3/ of the component New Widget Handler. The manipulation of the argument URL leads to cross site...