CVE-2024-12814

CVE-2024-12814 affects the WordPress plugin Loan Comparison (shortcode loancomparison) up to version 2.0, enablingStored XSS by authenticated attackers (Contributor+) via user-supplied shortcode attributes. Exploitation could inject scripts on pages viewed by other users. Remediation: update to L...

CVE-2024-12594

The Custom Login Page Styler – Login Protected Private Site , Change wp-admin login url , WordPress login logo , Temporary admin login access , Rename login , Login customizer, Hide wp-login – Limit Login Attempts – Locked Site plugin for WordPress is vulnerable to privilege escalation due to a...

CVE-2024-12622

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpcartbutton' and 'wpcartdisplayproduct' shortcodes in all versions up to, and including, 5.0.7 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11885

The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'njtelebutton shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12622 WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpcartbutton' and 'wpcartdisplayproduct' shortcodes in all versions up to, and including, 5.0.7 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-12594

CVE-2024-12594 concerns the WordPress plugin “Custom Login Page Styler” (ALL In One Custom Login Page family) where a missing capability check on AJAX action lps_generate_temp_access_url allows authenticated users with Subscriber+ privileges to impersonate other users. The CVE covers all versions...

CVE-2024-12622 WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpcartbutton' and 'wpcartdisplayproduct' shortcodes in all versions up to, and including, 5.0.7 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11885 NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'njtelebutton shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12210 Print Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcdnremoveshoplogo' AJAX action in all versions up to, and including, 5.4.0. This makes it possible for authenticated attackers, wit...

CVE-2024-11885 NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'njtelebutton shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12617

The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and...

CVE-2024-12518

The ShMapper by Teplitsa plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shmMap' shortcode in all versions up to, and including, 1.4.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12507

The Optio Dentistry plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the optio-lightbox shortcode, affecting all versions up to 2.1, due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can injec...

CVE-2024-12617 WC Price History for Omnibus <= 2.1.3 - Missing Authorization

The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and...

CVE-2024-12507 Optio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12507 Optio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12617

CVE-2024-12617 affects WC Price History for Omnibus (WordPress). The issue is a missing capability check on several AJAX actions, permitting authenticated users with Subscriber level and above to view and modify history data. This is confirmed by Red Hat/Wordfence references noting the WC Price H...

CVE-2024-12518 shMapper by Teplitsa <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

The ShMapper by Teplitsa plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shmMap' shortcode in all versions up to, and including, 1.4.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin Database Backup and check Tables Automated With Scheduler 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...

CVE-2024-11230

CVE-2024-11230 affects Ultimate Addons for Elementor (formerly Elementor Header & Footer Builder): Stored XSS via the Page Title Widget in Elementor Header & Footer Builder versions up to 1.6.46. Exploitation requires authenticated access (Contributor+). Patch is applied; update to the fixed rele...