CVE-2024-2491

Technical details about CVE-2024-2491 are not provided in the supplied documents. Please monitor for official advisories for affected versions, impact, and fixes.

CVE-2024-2491 PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*

The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmltag attribute of multiple widgets in all versions up to, and including, 2.7.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-2948

CVE-2024-2948 affects the WordPress Favorites plugin: all versions up to 2.3.3 are vulnerable to Stored XSS via the user_favorites shortcode due to insufficient input sanitization/output escaping on attributes like no_favorites. Exploitation requires contributor+ access and can inject scripts tha...

CVE-2024-2143

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2141

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2142

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-2140 Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Icons widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-2142

CVE-2024-2142 affects the Ultimate Addons for Beaver Builder – Lite WordPress plugin. It is a Stored Cross-Site Scripting vulnerability in the Info Table widget present in versions up to 1.5.7, caused by insufficient input sanitization and output escaping. An attacker with contributor-level acces...

CVE-2024-2142

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-2141 Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2141 Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2143

CVE-2024-2143 affects the Ultimate Addons for Beaver Builder – Lite WordPress plugin. It enables Stored XSS via the Heading widget in all versions up to 1.5.7 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher, all...

CVE-2024-2794

CVE-2024-2794 – The Gutenberg Block Editor Toolkit – EditorsKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘editorskit’ shortcode in all versions up to and including 1.40.4. The Red Hat CVE entry confirms the issue stems from insufficient input sanitization...

CVE-2024-0367

The CVE affects Unlimited Elements For Elementor (WordPress) up to version 1.5.96, with Stored Cross-Site Scripting via the link field of an installed widget (e.g., Button Link). Root cause: insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated use...

CVE-2024-2047

The CVE-2024-2047 entry affects ElementsKit Elementor addons and Templates Library (ElementsKit Lite) for WordPress. The root cause is Local File Inclusion via render_raw in all versions up to 3.0.6. This allows an authenticated attacker with contributor+ privileges to include and execute arbitra...

CVE-2024-2047 ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the renderraw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files o...

WordPress Pods plugin <= 3.0.10 - Authenticated (Contributor+) Remote Code Execution via Shortcode vulnerability

Authenticated Contributor+ Remote Code Execution via Shortcode vulnerability discovered by Nex Team in WordPress Plugin Pods versions = 3.0.10...

CVE-2024-2250

CVE-2024-2250 — The 140+ Widgets | Best Addons For Elementor – FREE (WordPress) is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to 1.4.2 due to insufficient input sanitization and output escaping. This permits authenticated attackers with contributor-level or...

CVE-2024-1858

The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via deserialization of untrusted input through post meta data. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2024-2280

CVE-2024-2280 : Stored XSS in the Better Elementor Addons WordPress plugin (versions up to and including 1.4.1) due to insufficient input sanitization and output escaping of widget link URL values. Authenticated attackers with contributor-level permissions can inject scripts that execute when use...