WordPress Gutentor plugin <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Countdown Widget vulnerability discovered by Webbernaut in WordPress Plugin Gutentor versions = 3.3.9...

Drupal Megamenu Framework module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drew Webber in WordPress Module Megamenu Framework versions...

Drupal Print Anything module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drew Webber in WordPress Module Print Anything versions...

WordPress Responsive Lightbox plugin <= 2.4.8 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Responsive Lightbox versions = 2.4.8...

WordPress Accordion Slider plugin <= 1.9.12 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Accordion Slider versions = 1.9.12...

WordPress B Testimonial plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin B Testimonial versions = 1.2.2...

WordPress Flower Delivery by Florist One plugin <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Flower Delivery by Florist One versions = 3.9...

WordPress Dollie Hub plugin <= 6.2.0 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Dollie Hub versions = 6.2.0...

WordPress Funnelforms Free plugin <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Funnelforms Free versions = 3.7.5.1...

CVE-2024-46625

The digital platform InfoDom Performa 365 v4.0.1 contains an authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint. An attacker with necessary privileges can execute arbitrary code by uploading a crafted SVG file . No specific patch version is currently identifie...

WordPress Charity Addon for Elementor plugin <= 1.3.3 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Charity Addon for Elementor versions = 1.3.3...

WordPress Scratch & Win – Giveaways and Contests plugin <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Scratch & Win – Giveaways and Contests versions = 2.6.9...

WordPress Royal Elementor Addons and Templates plugin <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Royal Elementor Addons versions = 1.7.1003...

WordPress Login with Vipps and MobilePay plugin <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Login with Vipps and MobilePay versions = 1.3.3...

WordPress File Manager Pro – Filester plugin <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin File Manager Pro versions = 1.8.4...

Drupal Tarte au Citron module 2.0.0-2.0.4 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff in WordPress Module Tarte au Citron versions 2.0.0-2.0.4...

CVE-2024-10308 Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Attesa Extra plugin <= 1.4.2 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Attesa Extra versions = 1.4.2...

WordPress NiceJob plugin <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin NiceJob versions = 3.7.1...

WordPress Beds24 Online Booking plugin <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via beds24-link Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Beds24 Online Booking versions = 2.0.27...