PT-2021-15813

Name of the Vulnerable Software and Affected Versions Clever Addons for Elementor versions prior to 2.1.0 Description The issue allows lower-privileged users, such as contributors, to perform stored Cross-Site Scripting XSS attacks. This is possible due to several vulnerable widgets in the plugin...

PT-2021-15811

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor versions prior to 1.30.0 Description The issue concerns stored Cross-Site Scripting XSS that can be exploited by lower-privileged users, such as contributors, through several widgets in the plugin. This is achieve...

CVE-2021-24263: Improper Neutralization of Input During Web Page Generation

The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

PT-2021-15802

Name of the Vulnerable Software and Affected Versions WooLentor – WooCommerce Elementor Addons + Builder versions prior to 1.8.6 Description The issue concerns a stored Cross-Site Scripting XSS vulnerability in a widget of the plugin, which can be exploited by lower-privileged users, such as...

PT-2021-15800

Name of the Vulnerable Software and Affected Versions Livemesh Addons for Elementor versions prior to 6.8 Description The issue concerns stored Cross-Site Scripting XSS that can be exploited by lower-privileged users, such as contributors. The vulnerability is present in several widgets and can b...

Elementor 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A security vulnerability exists in WordPress HT Mega...

CVE-2021-24260: Improper Neutralization of Input During Web Page Generation

The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.10.33 and fixes at least the following security issues: A race condition in Linux kernel SCTP sockets net/sctp/socket.c before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If...

Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSS

The plugins have a number of widgets that are vulnerable to stored Cross-Site ScriptingXSS by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “titletag” parameter. Although the element control lists a fixed set of possible html tags, it is possib...

BlackCat CMS 1.3.6 - (Multiple) Stored Cross-Site Scripting (XSS) Vulnerability

Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting XSS Exploit Author: Ömer Hasan Durmuş Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Step 1 : Login to admin account in...

BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS)

Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting XSS Date: 04/07/2021 Exploit Author: Ömer Hasan Durmuş Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Step 1 : Login to admin account in...

Kaswara Modern VC Addons (0-day) - Unauthenticated Arbitrary File Upload

The plugin allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fontsicon directory with no checks for malicious files such as PHP. The vendor has been unresponsive to both the reporter and Envato,...

Kaswara Modern VC Addons (0-day) - Unauthenticated Arbitrary File Upload

The plugin allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fontsicon directory with no checks for malicious files such as PHP. The vendor has been unresponsive to both the reporter and Envato,...

WordPress Clever Addons for Elementor plugin <= 2.0.15 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Ramuel Gall Wordfence in WordPress Clever Addons for Elementor plugin versions = 2.0.15. Solution Update the WordPress Clever Addons for Elementor plugin to the latest available version at least 2.1.0...

WordPress Ultimate Addons for Elementor premium plugin <= 1.29.2 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by WordFence in WordPress Ultimate Addons for Elementor premium plugin versions = 1.29.2. Solution Update the WordPress Ultimate Addons for Elementor premium plugin to the latest available version at least 1.30.0...

WordPress PowerPack Addons for Elementor plugin <= 2.3.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by WordFence in WordPress PowerPack Addons for Elementor plugin versions = 2.3.1. Solution Update the WordPress PowerPack Addons for Elementor plugin to the latest available version at least 2.3.2...

HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSS

The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “htmegacalltoaction” widget accepts a...

Livemesh Addons for Elementor < 6.8 - Contributor+ Stored XSS

The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Heading” widget accepts a “titletag” parameter. Although the element control...

Premium Addons for Elementor < 4.2.8 - Contributor+ Stored Cross-Site Scripting (XSS)

The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Testimonials” widget accepts a “premiumtestimonialpersonnamesize” parameter...

WordPress Livemesh Addons for Elementor plugin <= 6.7.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by WordFence in WordPress Livemesh Addons for Elementor plugin versions = 6.7.1. Solution Update the WordPress Livemesh Addons for Elementor plugin to the latest available version at least 6.8...