CVE-2024-8721 Tracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Tracking Code Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tracking code field in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...

CVE-2024-11885 NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'njtelebutton shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-17322 · WordPress · Ninjateam Chat For Telegram

Name of the Vulnerable Software and Affected Versions: NinjaTeam Chat for Telegram plugin for WordPress version 1.0 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'njtele button' shortcode in the NinjaTeam Chat for Telegram plugin for WordPress. This...

PT-2024-17520 · WordPress · Responsive Blocks

Name of the Vulnerable Software and Affected Versions: The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress versions up to, and including, 1.9.7 Description: The issue is related to Stored Cross-Site Scripting via the 'responsive-block-editor-addons/portfolio' block due to...

PT-2024-17329 · WordPress · The Text Prompter

Name of the Vulnerable Software and Affected Versions: The Text Prompter – Unlimited chatgpt text prompts for openai tasks plugin for WordPress versions up to, and including, 1.0.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'text prompter' shortcode due to...

PT-2024-39201 · WordPress · Tracking Code Manager

Name of the Vulnerable Software and Affected Versions: Tracking Code Manager plugin for WordPress versions up to, and including, 2.3.0 Description: The issue is related to Stored Cross-Site Scripting via the tracking code field due to insufficient input sanitization and output escaping. This allo...

PT-2024-16595 · Wpdevart · Wpdevart Booking Calendar

Name of the Vulnerable Software and Affected Versions: Booking Calendar WpDevArt plugin versions up to, and including, 3.2.19 Description: The issue is a time-based, blind SQL injection vulnerability via the id parameter in the "wpdevart booking calendar" shortcode. This vulnerability is due to...

CVE-2024-11230

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11230 Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-16845 · WordPress · Elementor Header & Footer Builder

Name of the Vulnerable Software and Affected Versions: Elementor Header & Footer Builder plugin for WordPress versions up to, and including, 1.6.46 Description: The issue is related to Stored Cross-Site Scripting via the size parameter due to insufficient input sanitization and output escaping...

CVE-2024-12591

The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wbsharesocial shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10453

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Settings in all versions up to, and including, 3.25.9 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-12588

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-9545

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auxcontactbox and auxgmaps shortcodes in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-10797 Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure

The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen Menu Elementor Widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers,...

CVE-2024-9545

CVE-2024-9545 : Shortcodes and extra features for Phlox theme store pages vulnerability enabling stored XSS via aux_contact_box and aux_gmaps shortcodes. Affected: Phlox theme (WordPress). Root cause: insufficient input sanitization/output escaping on user-supplied shortcode attributes. Impact: a...

CVE-2024-11938 One Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode

The One Click Upsell Funnel for WooCommerce – Funnel Builder for WordPress, Create WooCommerce Upsell, Post-Purchase Upsell & Cross Sell Offers that Boost Sales & Increase Profits with Sales Funnel Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's...

PT-2024-16293 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder plugin for WordPress versions up to, and including, 3.25.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Typography Settings due to insufficient input sanitization and output...

PT-2024-17666 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.16.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Staff widget due to insufficient input sanitization and...

CVE-2024-12509

The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedtwine' shortcode in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...