CVE-2024-1806: Improper Neutralization of Input During Web Page Generation

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 4.15.1 due to insufficient input sanitizati...

CVE-2024-2237: Improper Neutralization of Input During Web Page Generation

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2023-6880: Improper Neutralization of Input During Web Page Generation

The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 45.6.0 due to insufficient input sanitizatio...

Beaver Builder Addons by WPZOOM < 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget

Description The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2023-6954: Improper Neutralization of Input During Web Page Generation

The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Happy Elementor Addons < 3.10.1 - Contributor+ Stored Cross-Site Scripting

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's AGe Gate Widget in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on the user supplied header URL value. This makes it possible for authenticated attackers wi...

CVE-2024-1508: Improper Neutralization of Input During Web Page Generation

The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings'titletags'' attribute of the Mercury widget in all versions up to, and including, 3.13.2 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2024-1536: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's event calendar widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and outpu...

PT-2024-18024

Name of the Vulnerable Software and Affected Versions Exclusive Addons for Elementor plugin for WordPress versions up to, and including, 2.6.9 Description The issue is related to Stored Cross-Site Scripting via the Call To Action widget due to insufficient input sanitization and output escaping...

PT-2024-18101

Name of the Vulnerable Software and Affected Versions The Prime Slider – Addons For Elementor plugin for WordPress versions up to, and including, 3.13.2 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the settings'title...

CVE-2024-2286: Improper Neutralization of Input During Web Page Generation

The Sky Addons for Elementor Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link URL value in all versions up to, and including, 2.4.0 due to insufficient input...

PT-2024-15138

Name of the Vulnerable Software and Affected Versions Download Manager Pro plugin for WordPress versions up to, and including, 3.2.85 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcodes, allowing authenticate...

CVE-2024-2000: Improper Neutralization of Input During Web Page Generation

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigationdots' parameter of the Multi Scroll Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Elementor Addons by Livemesh < 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget

Description The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Posts Slider widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-18847

Name of the Vulnerable Software and Affected Versions The Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.32 Description The issue is related to Stored Cross-Site Scripting via the Registration Form widget due to insufficient input sanitization and output escaping...

PT-2024-18149

Name of the Vulnerable Software and Affected Versions Metform Elementor Contact Form Builder plugin for WordPress versions up to, and including, 3.8.3 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcodes,...

CVE-2024-2028: Improper Neutralization of Input During Web Page Generation

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Covid-19 Stats Widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-17975

Name of the Vulnerable Software and Affected Versions The Easy Accordion – Best Accordion FAQ Plugin for WordPress versions up to, and including, 2.3.4 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

CVE-2024-1684: Improper Neutralization of Input During Web Page Generation

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact form file field CSS metabox in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This...

CVE-2024-1996: Improper Neutralization of Input During Web Page Generation

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...