CVE-2024-9274

The CVE CVE-2024-9274 affects Elastik Page Builder for WordPress, with Stored Cross-Site Scripting via SVG file uploads in all versions up to 0.27.4 due to insufficient input sanitization and output escaping. Exploitation requires Author-level access or higher, and injected scripts run when a use...

CVE-2024-9269 Relogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Relogo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inje...

CVE-2024-9269

The CVE refers to the WordPress Relogo plugin (versions up to 0.4.2) and describes a Stored Cross-Site Scripting (XSS) flaw via SVG file uploads. Root cause: insufficient input sanitization and output escaping for uploaded SVGs. Impact: authenticated attackers with Author-level access+ can inject...

CVE-2024-7432

CVE-2024-7432 — Unseen Blog Theme (WordPress) is affected up to version 1.0.0. The issue is a PHP Object Injection via deserialization of untrusted input. Authenticated attackers with Contributor-level access or higher can inject a PHP object. No POP chain is confirmed in the core vulnerable soft...

CVE-2024-9119 SVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The SVG Complete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2024-8107

The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-8189

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmtmenuname’ parameter in all versions up to, and including, 0.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-8189

CVE-2024-8189 affects the WP MultiTasking – WP Utilities WordPress plugin. It is a stored XSS via the wpmt_menu_name parameter in all versions

CVE-2024-8547

The Simple Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's popup shortcode in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9023

The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwaloginform shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9023 WP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode

The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwaloginform shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-8547

CVE-2024-8547 affects the WordPress plugin Simple Popup Plugin (versions

CVE-2024-7149

CVE-2024-7149 — The Event Manager/Events Calendar/Tickets/Registrations – Eventin WordPress plugin (

CVE-2024-7149 Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, t...

CVE-2024-8681 Premium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all versions up to, and including, 4.10.52 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-8991

CVE-2024-8991 : The OSM – OpenStreetMap WordPress plugin has a stored XSS in versions ≤ 6.1.0 via the osm_map and osm_map_v3 shortcodes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject scripts executed when user...

CVE-2024-9049

CVE-2024-9049 — Beaver Builder for WordPress: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via the Button Group Module in versions up to 2.8.3.6. Root cause: insufficient input sanitization and output escaping on user-supplied attributes in the Button Group. Impact: stored X...

CVE-2024-8922

The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.33.32 via deserialization of untrusted input in enquirydetail.php. This makes it possible for authenticated attackers, with...

CVE-2024-9177

CVE-2024-9177 concerns Themedy Toolbox for WordPress. The vulnerability is Stored Cross-Site Scripting (XSS) via multiple shortcodes (themedy_col, themedy_social_link, themedy_alertbox, themedy_pullleft; and themedy_button for versions ≤ 1.0.15) caused by insufficient input sanitization and outpu...

CVE-2024-9117

The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...