CVE-2024-3809

The Porto Theme – Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the ‘slideshowtype’ post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2024-3807

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via ‘portopageheadershortcodetype’, ‘slideshowtype’ and ‘postlayout’ post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to...

Email Subscribers by Icegram Express < 5.7.20 - Missing Authorization in handle_ajax_request

Description The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handleajaxrequest function in all versions up to, and including, 5.7.19. This makes it possible f...

Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) < 3.5.4 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting

Description The Sina Extension for Elementor Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via several parameters in versions up to, and including, 3.5.3 due to insufficien...

CVE-2024-4487

CVE-2024-4487 affects Blocksy Companion for WordPress. The vulnerability is a Stored Cross-Site Scripting via SVG uploads in Blocksy Companion versions up to and including 2.0.45, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contribu...

CVE-2024-4329

CVE-2024-4329 affects the WordPress plugin Thim Elementor Kit (vulnerable components: id parameter in the plugin’s pages) up to version 1.1.9. The root cause is insufficient input sanitization and output escaping, enabling stored cross-site scripting (XSS). Exploitation requires an authenticated ...

CVE-2024-4630

CVE-2024-4630 : The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_upload_mimes function in versions up to 4.2.0, due to insufficient input sanitization and output escaping. This enables authenti...

CVE-2024-4209

The vulnerability CVE-2024-4209 affects Gutenberg Blocks with AI by Kadence Blocks – Page Builder Features for WordPress. It is a Stored Cross-Site Scripting (XSS) via the countdown timer in versions up to 3.2.36, caused by insufficient input sanitization and output escaping on user-supplied attr...

CVE-2024-4430

CVE-2024-4430 affects Beaver Builder – WordPress Page Builder. Vulnerable in all versions up to and including 2.8.1.2 via the photo widget crop attribute due to insufficient input sanitization/output escaping. Exploitation requires at least contributor (or higher) privileges and user interaction;...

CVE-2024-4417

CVE-2024-4417 is for Falang multilanguage for WordPress. The vulnerability is a Stored Cross-Site Scripting via admin settings in Falang versions ≤ 1.3.49, caused by insufficient input sanitization and output escaping. It affects multisite setups and installations where unfiltered_html is disable...

CVE-2024-34245

An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in makehtmljsaction.php...

CVE-2024-34245

An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in makehtmljsaction.php...

CVE-2024-34245

DedeCMS version 5.7.114 is susceptible to an arbitrary file read vulnerability. An authenticated attacker can read arbitrary files by specifying any path via the makehtml_js_action.php file. To mitigate this risk, it is recommended to restrict access to makehtml_js_action.php until a formal patch...

CVE-2024-4490

The CVE-2024-4490 entry concerns the Elegant Themes Divi product family (Divi theme, Divi Extra, Divi Page Builder) with DOM-Based Stored XSS via the title parameter in versions up to and including 4.25.0. The vulnerability arises from insufficient input sanitization and output escaping, enabling...

CVE-2024-4277

CVE-2024-4277 affects LearnPress – WordPress LMS Plugin. Affected: all WordPress versions up to and including 4.2.6.5. Root cause: insufficient input sanitization and output escaping in the layout_html parameter. Impact: authenticated attackers with contributor-level access can store scripts that...

CVE-2024-3956

CVE-2024-3956 (Pods – Custom Content Types and Fields, WordPress) is a stored XSS in the Pod Form Redirect URL triggered by authenticated users with contributor-level access or higher, affecting all versions up to 3.2.1. Root cause: insufficient input sanitization and output escaping on user-supp...

CVE-2024-4398

CVE-2024-4398 affects the HTML5 Audio Player – Audio Player Plugin for WordPress. The vulnerability is a Stored Cross‑Site Scripting (XSS) in the plugin’s widgets due to insufficient input sanitization and output escaping for user-supplied attributes, viable when an attacker has Contributor or hi...

CVE-2024-4275

CVE-2024-4275 affects the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders. The Stored XSS vulnerability is in the Interactive Circle widget due to insufficient input sanitization and output escaping on user-supplied attributes, allo...

CVE-2024-4481

CVE-2024-4481 affects Gutenberg Blocks with AI by Kadence WP (WordPress). The WordPress plugin Kadence Blocks vulnerability allows Stored XSS via the link attribute in blocks across all versions up to 3.2.36. attacker requires at least contributor-level authentication to inject scripts into pages...

Beaver Builder < 2.8.1.3 - Contributor+ Stored Cross-Site Scripting via photo widget crop attribute

Description The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attribute in all versions up to, and including, 2.8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for...