CVE-2024-12445

The RightMessage WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rmarea' shortcode in all versions up to, and including, 0.9.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12462

The YOGO Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yogo-calendar' shortcode in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-12457

The Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vchat' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escapi...

CVE-2024-12207

The Toggles Shortcode and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12140

The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it...

CVE-2024-11445

The Image Magnify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'imagemagnify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11382

The Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'commonninja' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output...

CVE-2024-11337

The Horoscope And Tarot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'divinehoroscope' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11382

CVE-2024-11382 – Common Ninja WordPress widget plugin : The Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites plugin is vulnerable to Stored Cross-Site Scripting via the plugin shortcode commonninja in all versions up to 1.1.0. The issue arises from insuf...

CVE-2024-12445

CVE-2024-12445 affects the RightMessage WP WordPress plugin. The vulnerability is Stored Cross-Site Scripting in the plugin’s rm_area shortcode, due to insufficient input sanitization and output escaping on user-supplied attributes. It affects all versions up to and including 0.9.7. Successful ex...

CVE-2024-12332 School Management System – WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injection

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

CVE-2024-12140

The CVE-2024-12140 incident concerns the WordPress plugin Elementor Addons AI Addons (70 Widgets, Premium Templates, Ultimate Elements). Affected component: render function in versions up to and including 2.2.1. Root cause: insufficient restrictions on which templates can be included, enabling in...

CVE-2024-12140 Elementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure

The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it...

CVE-2024-12140 Elementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure

The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it...

CVE-2024-12453 Uptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Uptodown APK Download Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'utd-widget' shortcode in all versions up to, and including, 0.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-12453

CVE-2024-12453 affects the Uptodown APK Download Widget for WordPress. It is a Stored Cross-Site Scripting vulnerability in the utd-widget shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Affected versions are all up to 0.1.2. Exploitation requires...

CVE-2024-12453 Uptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Uptodown APK Download Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'utd-widget' shortcode in all versions up to, and including, 0.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-12457

CVE-2024-12457 : In the WordPress plugin “Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode” there is a Stored Cross‑Site Scripting vulnerability via the plugin shortcode ‘vchat’, affecting all versions up to 1.7.2 (per initial description). Exploitation ...

CVE-2024-12457 Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vchat' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escapi...

CVE-2024-11337

CVE-2024-11337 concerns the Horoscope And Tarot WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin shortcode divine_horoscope, affecting all versions up to and including 1.3.0. The root cause is insufficient input sanitization and output escaping on user-sup...