CVE-2024-5229

CVE-2024-5229 affects the Primary Addon for Elementor plugin (WordPress) through the Pricing Table widget in versions up to and including 1.5.5. The vulnerability is a Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes. Exploit...

CVE-2024-4455

The CVE-2024-4455 entry concerns the WordPress plugin YITH WooCommerce Ajax Search. Affected versions are up to and including 2.4.0, with Stored Cross-Site Scripting via the input parameter (the original description references the item parameter; the nuclei template specifies the queryString para...

CVE-2024-5060

The WordPress plugin WordPress: LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to 1.10.9 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contributor lev...

CVE-2024-2861

CVE-2024-2861 affects the ProfilePress WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via the ProfilePress User Panel widget in all versions up to 4.15.8, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires a...

YITH WooCommerce Ajax Search < 2.4.1 - Unauthenticated Stored Cross-Site Scripting

Description The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

Prime Slider < 3.14.2 - Contributor+ Stored XSS via Pagepiling Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Pagepiling widget due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

ProfilePress < 4.15.9 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2024-3926

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customattributes value in widgets in all versions up to, and including, 5.6.1 due to insufficient input sanitization...

CVE-2023-6487

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2119 LuckyWP Table of Contents <= 2.1.5 - Reflected Cross-Site Scripting

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2024-2119

CVE-2024-2119 describes a Reflected XSS in the LuckyWP Table of Contents WordPress plugin. The vulnerability exists in the attrs parameter and affects all versions up to and including 2.1.4 due to insufficient input sanitization and output escaping. This can allow unauthenticated attackers to inj...

CVE-2024-2163

CVE-2024-2163 affects Ninja Beaver Add-ons for Beaver Builder (WordPress). The issue is stored Cross-Site Scripting via widget attributes (e.g., URLs) in the plugin’s widgets. It is exploitable by authenticated attackers with contributor-level permissions and above, allowing arbitrary scripts to ...

CVE-2024-1762

CVE-2024-1762 affects NextScripts: Social Networks Auto-Poster for WordPress. The vulnerability is Stored XSS in HTTP_USER_AGENT present in all versions up to 4.4.3 due to insufficient sanitization/escaping. Exploitation requires the victim to view the page with the cron events list (“All Cron Ev...

CVE-2024-4971

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2024-5092

CVE-2024-5092 affects the WordPress plugin Elegant Addons for elementor (all versions up to 1.0.8). Connected sources confirm a stored cross-site scripting vulnerability in the Switcher, Slider, and Iconbox widgets caused by insufficient input sanitization and output escaping on user-supplied att...

CVE-2024-4971 LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2024-4971

CVE-2024-4971 refers to LearnPress – WordPress LMS Plugin. Affected: LearnPress ≤ 4.2.6.6. Issue: Stored Cross-Site Scripting via id parameter (per Wordfence details) arising from input handling; the initial description cites Reflected XSS. Root cause per sources: insufficient input sanitization/...

SiteOrigin Widgets Bundle < 1.61.0 - Contributor+ Stored XSS via siteorigin_widget Shortcode

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Opal Estate Pro <= 1.7.6 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the agent latitude and longitude parameters due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in...

CVE-2024-3519

Summary of CVE-2024-3519 (Media Library Assistant, WordPress): The WordPress plugin Media Library Assistant is vulnerable to a Reflected Cross-Site Scripting (XSS) via the lang parameter in versions up to 3.15. The issue arises from insufficient input sanitization and output escaping, enabling un...