CVE-2024-4268

CVE-2024-4268 – Ultimate Blocks (WordPress Blocks Plugin) vulnerable to a Stored XSS in all versions up to 3.1.9 due to insufficient input sanitization and output escaping on user-supplied attributes. Requires authenticated access (Contributor+) to inject scripts that run when users load injected...

CVE-2024-6012

CVE-2024-6012 affects the Cost Calculator Builder plugin for WordPress. The vulnerability arises from a missing capability check in embed-create-page and embed-insert-pages, affecting all versions up to and including 3.2.12. This permits authenticated attackers with Subscriber-level access or hig...

CVE-2024-6012 Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, wit...

CVE-2024-6012 Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, wit...

CVE-2024-3513

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag parameter in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-5504

The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within the plugin's Writing Effect Headline widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user...

CVE-2024-3513

CVE-2024-3513 affects Ultimate Blocks – WordPress Blocks Plugin, where Stored Cross-Site Scripting is possible via the title tag parameter in all versions up to and including 3.1.9. The vulnerability requires authenticated access (contributors or higher) and can let an attacker inject scripts tha...

CVE-2024-5504

CVE-2024-5504 affects the Rife Elementor Extensions & Templates plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting flaw in the Writing Effect Headline widget via the tag attribute, exploited by authenticated attackers with contributor-level access and above, due to insuffici...

CVE-2024-5219 Easy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scripting

The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2024-5349

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'mapstyle' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

CVE-2024-5349

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'mapstyle' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

PT-2024-18037 · Unknown · The Post Grid – Shortcode

Name of the Vulnerable Software and Affected Versions: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin versions up to, and including, 7.7.1 Description: The issue is related to Stored Cross-Site Scripting via the section title tag attribute due to insufficient...

CVE-2023-50952

IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 275774...

CVE-2024-5790

CVE-2024-5790 is a Stored Cross-Site Scripting vulnerability in Happy Addons for Elementor on WordPress. Accessed via the Gradient Heading widget’s url attribute, it affects all versions up to and including 3.11.1 and can be exploited by authenticated users with Contributor+ privileges to inject ...

CVE-2024-5666

CVE-2024-5666 affects Extensions for Elementor (WordPress) by vulnerability in the EE Button widget’s url parameter, enabling Stored XSS via insufficient input sanitization and output escaping. Affected versions: all up to and including 2.0.30. Exploitation requires authenticated access (Contribu...

CVE-2024-6363

CVE-2024-6363 applies to the WordPress Stock Ticker plugin. The vulnerability is a Stored Cross-Site Scripting flaw in the stock_ticker shortcode due to insufficient input sanitization and output escaping. It affects all versions up to and including 3.24.4. Exploitation requires authentication (C...

CVE-2024-5942

CVE-2024-5942 affects the WordPress Page and Post Clone plugin. The issue is an Insecure Direct Object Reference in the content_clone function due to missing validation on a user-controlled key, enabling authenticated attackers with Author+ access to clone and read private posts. Technical detail...

CVE-2024-5925

CVE-2024-5925 affects the WordPress theme Theron Lite. The issue is a Stored Cross-Site Scripting (XSS) via the url parameter in the theme’s Button shortcode in all versions up to and including 2.0, caused by insufficient input sanitization and output escaping. The vulnerability requires authenti...

CVE-2024-5925 Theron Lite <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

The Theron Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2024-5424

CVE-2024-5424 affects Gallery Blocks with Lightbox (WordPress plugin) and is caused by insufficient input sanitization/escaping in the galleryID and className parameters, enabling Stored XSS. The vulnerability is exploitable by authenticated users with Contributor-level access or higher, affectin...