WordPress aThemes Addons for Elementor Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software aThemes Addons for Elementor Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51675 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8c1a41b721e0 Credits Khalid Yusuf Required...

WordPress aThemes Starter Sites plugin <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by wesley wcraft in WordPress Plugin aThemes Starter Sites versions = 1.0.53...

WordPress aThemes Starter Sites Plugin <= 1.0.53 is vulnerable to Cross Site Scripting (XSS)

Software aThemes Starter Sites Type Plugin Vulnerable versions = 1.0.53 Fixed in 1.0.54 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6897 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 14d453143684 Credits wesley wcraft...

CVE-2024-6897

The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access an...

CVE-2024-6897 aThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access an...

CVE-2024-6897

CVE-2024-6897 affects the WordPress plugin aThemes Starter Sites (versions ≤ 1.0.53). The issue is a Stored Cross-Site Scripting (XSS) via SVG file uploads caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at the Author level or higher, enab...

CVE-2024-6897 aThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access an...

PT-2024-37938 · WordPress · Athemes Starter Sites

Name of the Vulnerable Software and Affected Versions: aThemes Starter Sites plugin for WordPress versions up to, and including, 1.0.53 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

CVE-2024-4473 Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-1447 Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all versions up to, and including, 1.25 due to insufficient input sanitization and output escaping on user supplied link. This makes it possible for authenticated...