CVE-2024-2618 Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2618

CVE-2024-2618 refers to the Elementor Header & Footer Builder plugin for WordPress. The Red Hat and WordPress‑centered sources confirm a Stored Cross‑Site Scripting vulnerability via the size attribute in all versions up to and including 1.6.26, caused by insufficient input sanitization and outpu...

CVE-2024-5205

The Videojs HTML5 Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videojsvideo shortcode in all versions up to, and including, 1.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5205

CVE-2024-5205 affects Videojs HTML5 Player plugin for WordPress. Stored XSS via the plugin’s videojs_video shortcode in all versions up to and including 1.1.11 due to insufficient input sanitization and output escaping. Exploitation requires authentication at contributor level or higher, enabling...

PT-2024-31279 · WordPress · The Plus Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress versions up to, and including, 5.5.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient...

WP Go Maps < 9.0.37 - Contributor+ Stored XSS via Shortcode

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

Custom Fonts – Host Your Fonts Locally < 2.1.5 - Author+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via svg file upload due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author level or higher, to inject arbitrary web scripts in pages that will execute whenever ...

Spectra < 2.13.1 - Author+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the ‘blockid’ parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that wi...

PT-2024-15898 · WordPress · Schema App Structured Data

Name of the Vulnerable Software and Affected Versions: The Schema App Structured Data plugin for WordPress versions prior to 2.1.1 Description: The issue allows authenticated attackers with subscriber access or higher to update or delete post metadata due to a missing capability check on the...

CVE-2024-4365

CVE-2024-4365 affects the WordPress plugin Advanced iFrame . It is a Stored Cross-Site Scripting (XSS) vulnerability in the parameter add_iframe_url_as_param_direct , present in versions up to and including 2024.3. The root cause is insufficient input sanitization and output escaping . An attacke...

CVE-2024-3997

The Prime Slider – Addons For Elementor Revolution of a slider, Hero Slider, Ecommerce Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pagepiling widget in all versions up to, and including, 3.14.1 due to insufficient input sanitization and output escapin...

CVE-2024-4378

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets in all versions up to, and including, 4.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-1815

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Gallery block in all versions up to, and including, 2.12.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

CVE-2024-4378

CVE-2024-4378 affects Premium Addons for Elementor on WordPress. The vulnerability is Stored XSS in the plugin’s menu and shape widgets due to insufficient input sanitization/output escaping for user-supplied attributes in versions up to 4.10.30. It requires authentication at contributor level or...

CVE-2024-1814

CVE-2024-1814 affects Spectra – WordPress Gutenberg Blocks plugin for WordPress. It is a Stored XSS in the Testimonial block across all versions up to 2.12.8, caused by insufficient input sanitization and output escaping of user-provided attributes. Authenticated attackers with contributor-level ...

CVE-2024-3997

The CVE-2024-3997 issue affects WordPress plugin Prime Slider – Addons For Elementor (bdthemes-prime-slider-lite). It is a Stored Cross-Site Scripting vulnerability in the Pagepiling widget, present in all versions up to 3.14.1, caused by insufficient input sanitization and output escaping on use...

CVE-2024-1815

The CVE concerns Spectra – WordPress Gutenberg Blocks (Spectra plugin) with Stored Cross-Site Scripting via the Image Gallery block. The issue affects all versions up to and including 2.12.8 and arises from insufficient input sanitization and output escaping on user-supplied attributes, enabling ...

CVE-2024-2861

The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2861

CVE-2024-2861 affects the ProfilePress WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via the ProfilePress User Panel widget in all versions up to 4.15.8, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires a...

CVE-2024-2861 ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget

The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...