CVE-2023-5615: Improper Neutralization of Input During Web Page Generation

The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5613: Improper Neutralization of Input During Web Page Generation

The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2023-32216

Name of the Vulnerable Software and Affected Versions Skype Legacy Buttons plugin for WordPress versions up to, and including, 3.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode due to insufficient input sanitization and output escaping o...

CVE-2023-5614: Improper Neutralization of Input During Web Page Generation

The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themeswitchalist' shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2023-31760

Name of the Vulnerable Software and Affected Versions WP Mailto Links – Protect Email Addresses plugin for WordPress versions up to, and including, 3.1.3 Description The issue is related to Stored Cross-Site Scripting via the wpml mailto shortcode due to insufficient input sanitization and output...

PT-2023-31692

Name of the Vulnerable Software and Affected Versions Copy Anything to Clipboard plugin for WordPress versions up to, and including, 2.6.4 Description The issue is related to Stored Cross-Site Scripting via the 'copy' shortcode due to insufficient input sanitization and output escaping on...

CVE-2023-5639 Team Showcase <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2023-31107

Name of the Vulnerable Software and Affected Versions iframe plugin for WordPress versions up to, and including, 4.6 Description The issue is related to Stored Cross-Site Scripting via the iframe shortcode due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2023-5639: Improper Neutralization of Input During Web Page Generation

The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2023-31616

Name of the Vulnerable Software and Affected Versions Sitekit plugin for WordPress versions up to, and including, 1.4 Description The issue is related to Stored Cross-Site Scripting via the sitekit iframe shortcode due to insufficient input sanitization and output escaping. This allows...

CVE-2023-5638: Improper Neutralization of Input During Web Page Generation

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcjimage' shortcode in versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-5336: Improper Neutralization of Special Elements used in an SQL Command

The iPanorama 360 – WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2023-31907

Name of the Vulnerable Software and Affected Versions flowpaper plugin for WordPress versions up to, and including, 2.0.3 Description The issue is related to Stored Cross-Site Scripting via the flipbook shortcode due to insufficient input sanitization and output escaping on user-supplied...

CVE-2023-45049: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Ciprian Popescu YouTube Playlist Player plugin = 4.6.7 versions...

CVE-2023-31217: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in MyTechTalky User Location and IP plugin = 1.6 versions...

CVE-2023-45608: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Nicola Modugno Smart Cookie Kit plugin = 2.3.1 versions...

CVE-2023-45607: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Hector Cabrera WordPress Popular Posts plugin = 6.3.2 versions...

PT-2023-32230

Name of the Vulnerable Software and Affected Versions Team Showcase plugin for WordPress versions up to, and including, 2.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode due to insufficient input sanitization and output escaping on...

CVE-2023-45628: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in QROkes QR Twitter Widget plugin = 0.2.3 versions...

Cross site scripting

The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...