WordPress YMC Filter Cross-Site Script Vulnerability

WordPress YMC Filter 3.12.19 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the posttitle parameter. It allows for the injection of arbitrary web scripts by attackers with author-level or higher...

WordPress Themify Popup Cross-site Script Vulnerability

WordPress Themify Popup 1.4.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the parameter popupwidthunit. It may allow authenticated attackers with author-level or higher permissions to inject...

Nexcess Kadence Blocks: Cross-site Scripting Vulnerabilities

Nexcess Kadence Blocks versions 3.7.12 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping, leading to a stored-xss attack through the Block Font Family Attribute. Attackers with author-level or higher permissions ca...

PT-2026-99506

Name of the Vulnerable Software and Affected Versions Optima Express IDX WordPress plugin versions prior to 8.7.6 Description Stored Cross-Site Scripting occurs because the plugin fails to properly neutralize script values submitted through a REST endpoint. These values are stored and subsequentl...

PT-2026-95228

Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF versions prior to 6.5.6 Description The plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows authenticated attackers with...

CVE-2023-4142

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '-cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin...

EUVD-2023-54804

Malicious code in bioql PyPI...

EUVD-2023-54023

Malicious code in bioql PyPI...

EUVD-2023-59012

Malicious code in bioql PyPI...

EUVD-2024-44002

Malicious code in bioql PyPI...

CVE-2024-4366

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘blockid’ parameter in versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4633: Improper Neutralization of Input During Web Page Generation

The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addExtraMimeType’ function in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2024-31960

Name of the Vulnerable Software and Affected Versions The Slider and Carousel slider by Depicter plugin for WordPress versions up to, and including, 3.2.1 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the...

CVE-2023-5527: Improper Neutralization of Formula Elements in a CSV File

The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by...

CVE-2024-4366 Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘blockid’ parameter in versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4366

The CVE CVE-2024-4366 affects Spectra – WordPress Gutenberg Blocks (Spectra plugin) for WordPress. It enables Stored Cross-Site Scripting via the block_id parameter in versions up to and including 2.13.0 due to insufficient input sanitization and output escaping. The vulnerability can be exploite...

CVE-2024-4366: Improper Neutralization of Input During Web Page Generation

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘blockid’ parameter in versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2619 Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection

The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject...

CVE-2024-4635 Menu Icons by ThemeIsle <= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addmimetype’ function in versions up to, and including, 0.13.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

PT-2024-31967

Name of the Vulnerable Software and Affected Versions The Menu Icons by ThemeIsle plugin for WordPress versions up to, and including, 0.13.13 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the add mime type function...