CVE-2024-13387

The CVE-2024-13387 entry for the WP Responsive Tabs WordPress plugin has concrete details in connected records: the vulnerability is Stored Cross-Site Scripting via the wprtabs shortcode across all versions up to 1.2.9, caused by insufficient input sanitization and output escaping for user-suppli...

CVE-2024-11452

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'businesscategories' shortcode in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVE-2024-10970

The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-48122

Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges...

CVE-2024-13215 Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup

The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render' function in modules/modal-popup/widgets/modal-popup.php. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2024-13215

The CVE-2024-13215 entry concerns the Elementor Addon Elements for WordPress. It describes a Sensitive Information Exposure in the render function of modules/modal-popup/widgets/modal-popup.php, enabling authenticated attackers with Contributor-level access or higher to extract private, pending, ...

CVE-2024-11851 NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update

The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropackrmlnotification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher...

CVE-2024-11848 NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropackdismissnoticeforever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-12818

The WP Smart TV plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tv-video-player' shortcode in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-13351

The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rwimagebadge1' shortcode in all versions up to, and including, 5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-13351 Social proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rwimagebadge1' shortcode in all versions up to, and including, 5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-13351

CVE-2024-13351 affects the WordPress plugin Social proof testimonials and reviews by Repuso (vulnerable up to version 5.20). It is a Stored Cross-Site Scripting (XSS) via the rw_image_badge1 shortcode attribute, allowing authenticated attackers with contributor-level access or higher to inject sc...

CVE-2024-12818

CVE-2024-12818 refers to a Stored XSS in the WP Smart TV WordPress plugin via the tv-video-player shortcode, affecting all versions up to and including 2.1.8. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied shortcode attributes, allowing an authen...

CVE-2024-12818 WP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Smart TV plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tv-video-player' shortcode in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-10775

The CVE CVE-2024-10775 concerns the Piotnet Addons For Elementor WordPress plugin. Affected versions include all up to 2.4.32. The root cause is insufficient restrictions in the pafe-template shortcode, enabling Information Exposure. The vulnerability allows authenticated attackers with Contribut...

CVE-2024-11870

The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11870 Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11870

The CVE-2024-11870 entry concerns the WordPress plugin Event Registration Calendar By vcita. Affected software: Event Registration Calendar By vcita in all versions up to 1.4.0. Vulnerability: Stored Cross-Site Scripting via shortcode attributes due to insufficient input sanitization and output e...

CVE-2024-11870 Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13394

The CVE-2024-13394 vulnerability affects the ViewMedica 9 WordPress plugin (affected version range: all versions up to and including 1.4.15). The issue is Stored Cross-Site Scripting via the plugin’s viewmedica shortcode, caused by insufficient input sanitization and output escaping on user-suppl...