WordPress SureTriggers plugin <= 1.0.47 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Trigger Link Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin OttoKit versions = 1.0.47...

WordPress tagDiv Composer plugin <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via button Shortcode vulnerability discovered by Truoc Phan in WordPress Plugin tagDiv Composer versions = 4.8...

Brizy – Page Builder < 2.4.44 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL

Description The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress Ajax Load More plugin <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting vulnerability

Authenticated Contributor+ Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ajax Load More versions = 7.1.1...

WordPress DethemeKit For Elementor plugin <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via slitems Attribute vulnerability discovered by wesley wcraft in WordPress Plugin DethemeKit For Elementor versions = 2.1.4...

WordPress Comparison Slider plugin <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Comparison Slider versions = 1.0.5...

WordPress PowerPack Addons for Elementor plugin <= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin PowerPack Addons for Elementor versions = 2.7.19...

WordPress PostX plugin <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin PostX versions = 4.1.1...

WordPress WP STAGING plugin <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload vulnerability

Authenticated Admin+ Arbitrary File Upload vulnerability discovered by haidv35 in WordPress Plugin WP STAGING – Backup Duplicator & Migration versions = 3.4.3...

WordPress Unlimited Elements for Elementor plugin <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import vulnerability

AuthenticatedContributor+ Remote Code Execution via template import vulnerability discovered by Nex Team in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.89...

WordPress FooBox plugin < 2.7.28 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin FooBox Image Lightbox versions 2.7.28...

WordPress OptinMonster plugin <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin OptinMonster versions = 2.16.1...

WordPress Social Pixel plugin <= 2.1 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Bob Matyas in WordPress Plugin Social Pixel versions = 2.1...

WordPress Jitsi Shortcode plugin <= 0.1 - Authenticated Stored XSS via Shortcode vulnerability

Authenticated Stored XSS via Shortcode vulnerability discovered by Bob Matyas in WordPress Plugin Jitsi Shortcode versions = 0.1...

WordPress Spectra plugin <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Spectra versions = 2.13.0...

WordPress Custom Fonts – Host Your Fonts Locally plugin <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by James Myers ConfidenceRemainsHigh in WordPress Plugin Custom Fonts – Host Your Fonts Locally versions = 2.1.4...

WordPress The Plus Addons for Elementor plugin <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 5.5.4...

WordPress Advanced iFrame plugin <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Advanced iFrame versions = 2024.3...

WordPress WP Go Maps (formerly WP Google Maps) plugin <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Thanh Nam Tran in WordPress Plugin WP Go Maps versions = 9.0.36...

WordPressLayerSlider plugin 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin LayerSlider versions 7.11.0...