CVE-2024-10055

CVE-2024-10055 affects the WordPress plugin Click to Chat – WP Support All-in-One Floating Widget. It enables Stored Cross-Site Scripting via the wpsaio_snapchat shortcode in all versions up to and including 2.3.3. The vulnerability requires at least contributor-level authentication and allows an...

CVE-2024-10080

CVE-2024-10080 affects the WordPress plugin WP Easy Post Types (versions

CVE-2024-9703

CVE-2024-9703 refers to the Arconix Shortcodes WordPress plugin. The vulnerability is a Stored Cross-Site Scripting flaw in the button shortcode, present in all versions up to and including 2.1.12, caused by insufficient input sanitization and output escaping on user-supplied attributes. It can b...

CVE-2024-9373

The Elemenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-9361

The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveconfiguration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticate...

CVE-2024-8916

The Suki Sites Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9366 Easy Menu Manager | WPZest <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...

CVE-2024-9361

CVE-2024-9361 affects the WordPress plugin Bulk images optimizer – Resize, optimize, convert to webp, rename … (versions

CVE-2024-9452

CVE-2024-9452 (Branding plugin for WordPress) is a stored XSS vulnerability that affects all versions up to 1.0, enabling an authenticated attacker with Author-level access or higher to inject script via SVG file uploads. The available connected documents confirm the root cause as insufficient in...

CVE-2024-9452 Branding <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inje...

CVE-2024-8916

CVE-2024-8916 affects the WordPress plugin Suki Sites Import (WordPress). The vulnerability is a Stored Cross-Site Scripting (XSS) via SVG file uploads caused by insufficient input sanitization and output escaping. It applies to all versions up to and including 1.2.1. The attack requires authenti...

CVE-2024-9898

The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-7417

CVE-2024-7417 concerns the WordPress plugin Royal Elementor Addons and Templates (versions

CVE-2023-39593

Insecure permissions in the sysexec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed...

PT-2024-39595 · WordPress · Bulk Images Optimizer

Name of the Vulnerable Software and Affected Versions: The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to a missing capability check on the save configuration function, allowing...

CVE-2024-8921

The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acce...

CVE-2024-8921 Zita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acce...

CVE-2024-9444

The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2024-9444

CVE-2024-9444 : The ElementsReady Addons for Elementor WordPress plugin is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to and including 6.4.3 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Author leve...

CVE-2024-9444 ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...