CVE-2024-11774

The Outdooractive Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list2go' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11878 Category Post Slider <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11878 Category Post Slider <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11878

CVE-2024-11878 (Category Post Slider, WordPress) stores cross-site scripting via the plugin’s category-post-slider shortcode in all versions up to 1.4. It is an authenticated issue: attackers with Contributor+ (or higher) access can inject scripts that execute when users load a page containing th...

CVE-2024-12506 NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-12506

The connected Red Hat and Wordfence entries confirm CVE-2024-12506 affects the NACC WordPress Plugin (WordPress) via a Stored Cross-Site Scripting flaw in the nacc shortcode, exploitable on all versions up to 4.1.0 due to insufficient input sanitization and output escaping on user-supplied attrib...

CVE-2024-12506 NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-11774

CVE-2024-11774 affects the Outdooractive Embed WordPress plugin. The vulnerability is a Stored XSS in the list2go shortcode, exploitable by authenticated users with Contributor+ privileges to inject scripts on pages viewed by others. Affected: Outdooractive Embed, versions up to and including 1.5...

CVE-2024-11783

CVE-2024-11783 : The Financial Calculator WordPress plugin is vulnerable to stored XSS via the plugin shortcode finance_calculator in all versions up to 2.2.1. Authenticated users with Contributor+ privileges can inject scripts that execute when other users load affected pages. Connected Red Hat ...

CVE-2024-11893 Spoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spokibutton' shortcode in all versions up to, and including, 2.15.15 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-11783 Financial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Financial Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'financecalculator' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11893

CVE-2024-11893 affects the Spoki – Chat Buttons and WooCommerce Notifications WordPress plugin. The vulnerability is a Stored Cross‑Site Scripting flaw via the plugin’s spoki_button shortcode, exploitable by authenticated users with contributor-level access and above. The Initial description indi...

CVE-2024-11784 Sell Tickets Online – TicketSource Ticket Shop for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop' shortcode in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11784

CVE-2024-11784 affects the TicketSource Ticket Shop (Sell Tickets Online – TicketSource) WordPress plugin. Per connected documents, all versions up to 3.0.2 are vulnerable to a Stored Cross-Site Scripting (XSS) via the plugin shortcode ticketshop due to insufficient input sanitization and output ...

CVE-2024-9619

CVE-2024-9619 affects the WP SHAPES WordPress plugin. The vulnerability is Stored Cross-Site Scripting via SVG file uploads in all versions up to 1.0.0, caused by insufficient input sanitization and output escaping. It requires authenticated access at Author level or higher to exploit. The connec...

CVE-2024-9619 WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-12509

CVE-2024-12509 – Embed Twine (WordPress) : The WordPress Embed Twine plugin (versions up to 0.1.0) is vulnerable to a Stored Cross-Site Scripting (XSS) via the plugin’s embed_twine shortcode. The root cause is insufficient input sanitization and output escaping on user-provided attributes, enabli...

CVE-2024-11775 Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Particle Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'particleground' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11411 Spotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Spotlightr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode in all versions up to, and including, 0.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11411

The CVE-2024-11411 entry concerns the Spotlightr WordPress plugin, where a Stored Cross-Site Scripting (XSS) flaw exists via the spotlightr-v shortcode. The initial description states versions up to 0.1.9 are affected due to insufficient input sanitization/output escaping for user-supplied attrib...