CVE-2024-37565: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in TemeGUM Gum Elementor Addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through 1.3.5...

PT-2024-27664 · Unknown · Gum Elementor Addon

Name of the Vulnerable Software and Affected Versions: Gum Elementor Addon versions 1.3.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

CVE-2024-4780 Image Hover Effects – Elementor Addon <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link Parameter

The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihelink’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Image Hover Effects – Elementor Addon Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Image Hover Effects – Elementor Addon Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4780 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 68d93193adc6 Credits...

PT-2024-32819

Name of the Vulnerable Software and Affected Versions Image Hover Effects – Elementor Addon plugin for WordPress versions up to, and including, 1.4.3 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticat...

CVE-2024-4780: Improper Neutralization of Input During Web Page Generation

The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihelink’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Malicious code in sap-addon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b60b6a18d6564e1b58753fab08589e9941e86e3c4339782cff70667567a2b2d4 The OpenSSF Package Analysis project identified 'sap-addon' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7507 Malicious code in sap-addon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b60b6a18d6564e1b58753fab08589e9941e86e3c4339782cff70667567a2b2d4 The OpenSSF Package Analysis project identified 'sap-addon' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.112 - IP Address Spoofing to Antispam Bypass vulnerability

IP Address Spoofing to Antispam Bypass vulnerability discovered by shaman0x01 in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.112...

WordPress Gum Elementor Addon plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Plugin Gum Elementor Addon versions = 1.3.5...

WordPress Gum Elementor Addon Plugin <= 1.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Gum Elementor Addon Type Plugin Vulnerable versions = 1.3.5 Fixed in 1.3.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37565 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 69d28ead5f60 Credits Michael Required privilege Editor...

PT-2024-33162 · WordPress · Wpbits Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: WPBITS Addons For Elementor Page Builder plugin for WordPress versions up to, and including, 1.5 Description: The issue is related to Stored Cross-Site Scripting via several widgets due to insufficient input sanitization and output escaping o...

PT-2024-20120 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.3.7 Description: The issue allows authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server throug...

CVE-2024-4482

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping...

WordPress WPQA plugin < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF vulnerability

Arbitrary Category and Tag Follow/Unfollow via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin WPQA - Builder forms Addon versions 6.1.1...

WordPress WPQA plugin < 6.1.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WPQA - Builder forms Addon versions 6.1.1...

WordPress Contact Form 7 Multi-Step Addon plugin <= 1.0.5 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Contact Form 7 Multi-Step Addon versions = 1.0.5...

WordPress WPQA - Builder forms Addon Plugin < 6.1.1 is vulnerable to Cross Site Scripting (XSS)

Software WPQA - Builder forms Addon Type Plugin Vulnerable versions 6.1.1 Fixed in 6.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2375 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b62f23b8b86a Credits Bob Matyas...

WordPress WPQA - Builder forms Addon Plugin < 6.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WPQA - Builder forms Addon Type Plugin Vulnerable versions 6.1.1 Fixed in 6.1.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2376 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 77943f96c05b Credits Bob Matyas...

WordPress Contact Form 7 Multi-Step Addon Plugin <= 1.0.5 is vulnerable to Backdoor

Software Contact Form 7 Multi-Step Addon Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.7 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8aae8a0dc1cb Credits Sansec.io Required privilege Unauthenticated...