CVE-2024-9545

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auxcontactbox and auxgmaps shortcodes in all versions up to, and including, 2.17.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-10797

The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen Menu Elementor Widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers,...

CVE-2024-10797 Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure

The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen Menu Elementor Widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers,...

CVE-2024-12588

CVE-2024-12588 concerns the WordPress plugin Shortcodes and extra features for Phlox theme. Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in the Phlox staff widget, arising from insufficient input sanitization and output escaping of user-supplied attributes. Affected...

CVE-2024-9545

CVE-2024-9545 : Shortcodes and extra features for Phlox theme store pages vulnerability enabling stored XSS via aux_contact_box and aux_gmaps shortcodes. Affected: Phlox theme (WordPress). Root cause: insufficient input sanitization/output escaping on user-supplied shortcode attributes. Impact: a...

CVE-2024-12697

The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary w...

CVE-2024-11938

The One Click Upsell Funnel for WooCommerce – Funnel Builder for WordPress, Create WooCommerce Upsell, Post-Purchase Upsell & Cross Sell Offers that Boost Sales & Increase Profits with Sales Funnel Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's...

CVE-2024-11196 Multi-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode

The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mctagmap shortcode in all versions up to, and including, 17.0.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11196

CVE-2024-11196 affects the Multi-column Tag Map plugin for WordPress up to version 17.0.33, allowing Stored XSS in the mctagmap shortcode attributes via insufficient input sanitization and escaping. Exploitation requires authenticated access (Contributor+), and scripts run when pages with injecte...

CVE-2024-12697 real.Kit <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary w...

CVE-2024-11938

CVE-2024-11938 affects the One Click Upsell Funnel for WooCommerce – Free Funnel Builder to create WooCommerce Upsell (WordPress plugin). The vulnerability is a Stored Cross-Site Scripting (XSS) via the wps_wocuf_pro_yes shortcode attributes, caused by insufficient input sanitization and output e...

CVE-2024-12721 Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection

The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserialization of untrusted input from the 'wbcustomtabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level acce...

CVE-2024-12066 SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion

The SMSA Shippingofficial plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsadeletelabel function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2024-12721

The CVE-2024-12721 entry concerns the Custom Product Tabs For WooCommerce WordPress plugin. Connected Red Hat/Wordfence entries confirm: vulnerable through PHP Object Injection via deserialization from the wb_custom_tabs parameter in all versions up to 1.2.4. An authenticated attacker with Shop M...

GHSA-CMWP-442X-3RCV Piranha CMS Cross-site Scripting vulnerability

A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS...

CVE-2024-12509

The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedtwine' shortcode in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9619

The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-11878

The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11784

The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop' shortcode in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-12506

The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...