CVE-2024-0515 Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the removefromcompare function. This makes it possible for unauthenticated attackers to...

CVE-2024-1235

The Elementor Addons by Livemesh WordPress plugin is affected by CVE-2024-1235, a Stored Cross‑Site Scripting (XSS) due to insufficient input sanitization/escaping in the custom class field. Affected versions are all up to 8.3.2; a fix was released in 8.3.3. Exploitation requires authenticated ac...

CVE-2024-1411 PowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget

The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons Widget in all versions up to, and including, 2.7.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-1411

CVE-2024-1411 affects PowerPack Addons for Elementor (WordPress). The vulnerability is a Stored Cross‑Site Scripting (XSS) in the Twitter Buttons Widget, exploitable via its settings. Affected versions are up to and including 2.7.15. Exploitation requires at least contributor‑level access by an a...

CVE-2024-1411 PowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget

The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons Widget in all versions up to, and including, 2.7.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-1236

CVE-2024-1236 – Essential Addons for Elementor (Lite) vulnerability summary: A stored cross-site scripting flaw exists in the Filterable Controls label icon parameter, affecting all versions up to and including 5.9.8. The issue stems from insufficient input sanitization and output escaping, enabl...

CVE-2024-0513 Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the removefromwishlist function. This makes it possible for unauthenticated attackers to...

CVE-2024-0513

CVE-2024-0513 affects Royal Elementor Addons and Templates for WordPress up to version 1.3.87, due to missing/incorrect nonce validation in remove_from_wishlist, enabling unauthenticated CSRF to remove items from user wishlists if a site admin is tricked into clicking a forged link. Patch availab...

CVE-2024-0438 Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate in all versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

CVE-2024-1242 Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and including, 4.10.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-1242

The CVE-2024-1242 entry affects Premium Addons for Elementor (WordPress). Root cause: stored XSS via the button onclick attribute due to insufficient input sanitization and output escaping, exploitable by authenticated users with Contributor+ privileges. Affected versions: up to 4.10.18. Impact d...

PT-2024-15562 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.1 Description: The issue is related to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate due to insufficient input sanitization a...

PT-2024-15857 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.1 Description: The issue is related to Stored Cross-Site Scripting via the side image URL parameter in the Age Gate due to insufficient input sanitization...

PT-2024-17587 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.18 Description: The issue is related to Stored Cross-Site Scripting via the button onclick attribute due to insufficient input sanitization and output...

PT-2024-17568 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the label icon paramet...

CVE-2024-0513: Cross-Site Request Forgery (CSRF)

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the removefromwishlist function. This makes it possible for unauthenticated attackers to...

CVE-2024-0438: Improper Neutralization of Input During Web Page Generation

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate in all versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

PT-2024-17199 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Filterable Gallery Widget due to insufficient input sanitization an...

CVE-2024-1276: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Content Ticker arrow attribute in all versions up to, and including, 5.9.8 due to insufficient input sanitization and outpu...

CVE-2024-0515: Cross-Site Request Forgery (CSRF)

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the removefromcompare function. This makes it possible for unauthenticated attackers to...