CVE-2024-5439 Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the customurl parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2024-1940

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and including, 2.4.41 due to insufficient input sanitization performed only on the client side and insufficient output escaping. This makes it possible for...

CVE-2024-5317 Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1

The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2024-33026

Name of the Vulnerable Software and Affected Versions WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress versions up to, and including, 7.1.6 Description The issue is related to Stored Cross-Site Scripting via the plugin's su lightbox shortcode due to insufficient input sanitization...

CVE-2024-3469: Improper Neutralization of Input During Web Page Generation

The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-4697

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘headingtag’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-3888

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-4711

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajaxloadmore shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-2793

CVE-2024-2793 refers to the Visual Website Collaboration, Feedback & Project Management – Atarim WordPress plugin. The vulnerability is an unauthenticated Stored Cross-Site Scripting (XSS) via comments in all versions up to 3.30, caused by insufficient input sanitization and output escaping. Impa...

CVE-2024-35504

A cross-site scripting XSS vulnerability in the login page of FineSoft v8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL:errorname parameter after a failed login attempt...

CVE-2024-35504

A cross-site scripting XSS vulnerability in the login page of FineSoft v8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL:errorname parameter after a failed login attempt...

CVE-2024-3946

CVE-2024-3946 describes a stored cross-site scripting vulnerability in the WordPress plugin WP To Do (versions up to and including 1.3.0). The issue arises from insufficient input sanitization and output escaping in admin/settings handling, enabling an authenticated attacker with administrator-le...

CVE-2024-3063

CVE-2024-3063 refers to a Stored Cross‑Site Scripting (XSS) vulnerability in the WPB Elementor Addons WordPress plugin. Affected versions are all ≤ 1.0.9, due to insufficient input sanitization and output escaping on widget tag attributes. Exploitation requires authentication at contributor level...

CVE-2024-3190 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text field widget in all versions up to, and including, 1.5.107 due to insufficient input sanitization and output escaping on user supplied...

PT-2024-35704

Name of the Vulnerable Software and Affected Versions PowerPack Addons for Elementor plugin for WordPress versions up to, and including, 2.7.19 Description The issue is related to DOM-Based Stored Cross-Site Scripting. It occurs due to insufficient input sanitization and output escaping,...

CVE-2024-5039

CVE-2024-5039 concerns the HUSKY – Products Filter Professional for WooCommerce WordPress plugin. It enables Stored Cross-Site Scripting via shortcode attributes due to insufficient input sanitization and output escaping in versions up to 1.3.5.3. Exploitation requires authenticated access at con...

WP Next Post Navi <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The WP Next Post Navi plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to...

CVE-2024-35583: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Remarks input field...

CVE-2024-5229

CVE-2024-5229 affects the Primary Addon for Elementor plugin (WordPress) through the Pricing Table widget in versions up to and including 1.5.5. The vulnerability is a Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes. Exploit...

CVE-2024-4455

The YITH WooCommerce Ajax Search plugin for WordPress (versions up to and including 2.4.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping, specifically via the item parameter and the queryString parameter in the REST API...