PT-2024-17716 · WordPress · Real.Kit Plugin

Name of the Vulnerable Software and Affected Versions: real.Kit plugin for WordPress versions up to and including 5.1.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2024-17327 · WordPress · Spoki

Name of the Vulnerable Software and Affected Versions: Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress versions up to, and including, 2.15.14 Description: The issue is related to Stored Cross-Site Scripting via the plugin's spoki button shortcode due to insufficient input...

PT-2024-17250 · WordPress · Pcrecruiter Extensions

Name of the Vulnerable Software and Affected Versions: PCRecruiter Extensions plugin for WordPress versions up to, and including, 1.4.10 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode due to insufficient input sanitization and output...

PT-2024-17602 · WordPress · Ganohrs Toggle Shortcode

Name of the Vulnerable Software and Affected Versions: Ganohrs Toggle Shortcode plugin for WordPress versions up to, and including, 0.2.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode due to insufficient input sanitization and output escaping...

PT-2024-17315 · WordPress · Stripe Donation Plugin

Name of the Vulnerable Software and Affected Versions: Stripe Donation plugin for WordPress versions 1.2.5 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'stripe donation' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-17328 · WordPress · Permalinker

Name of the Vulnerable Software and Affected Versions: The Permalinker plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-17597 · WordPress · Posts/Products Views For Woocommerce

Name of the Vulnerable Software and Affected Versions: Posts and Products Views for WooCommerce plugin for WordPress versions up to, and including, 2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'papvfwc views' shortcode due to insufficient input sanitizatio...

CVE-2024-11910

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Hash Form plugin <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation vulnerability

Missing Authorization to Authenticated Contributor+ Form Style Creation vulnerability discovered by Noah Stead TurtleBurg in WordPress Plugin Hash Form versions = 1.2.1...

CVE-2024-10784

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-12059

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the elioptionvalue shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...

CVE-2024-10885

The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siqsearchbox' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

WordPress Listdom plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via shortcode Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Listdom versions = 3.7.0...

WordPress Responsive Videos plugin <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Responsive Videos versions = 2.1...

CVE-2024-12062

The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.2 via the 'nacharityelementortemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers...

PT-2024-16821 · WordPress · Embedpress

Name of the Vulnerable Software and Affected Versions: EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin for WordPress versions up to, and including, 4.1.3 Description: The issue is related to...

PT-2024-16620 · WordPress · The Tribute Testimonials

Name of the Vulnerable Software and Affected Versions: The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin versions up to, and including, 1.0.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's tribute testimonials slider shortcode due to insufficie...

WordPress Sirv plugin <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Option Deletion vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Sirv versions = 7.3.0...

CVE-2024-10268

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.8 due to insufficient input sanitization and output escaping on user supplie...

PT-2024-39352 · WordPress · The Social Proof (Testimonial) Slider

Name of the Vulnerable Software and Affected Versions: The Social Proof Testimonial Slider plugin for WordPress versions up to, and including, 2.2.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's spslider-block...