CVE-2024-10185 StreamWeasels YouTube Integration <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode

The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10312

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.4 via the render function in elements/tabs/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

WordPress Newsletters plugin <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via newslettersvideo Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Newsletters versions = 4.9.9.4...

PT-2024-16100 · WordPress · Streamweasels Youtube Integration

Name of the Vulnerable Software and Affected Versions: StreamWeasels YouTube Integration plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode due to insufficient input sanitization an...

PT-2024-16146 · Unknown · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor versions up to and including 4.10.60 Description: The issue is related to Stored Cross-Site Scripting via the Video Box widget due to insufficient input sanitization and output escaping on user-supplied attributes...

PT-2024-16126

Name of the Vulnerable Software and Affected Versions affiliate-toolkit plugin for WordPress versions up to, and including, 3.6.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's atkp product shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16179 · Unknown · Exclusive Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Exclusive Addons for Elementor versions up to, and including, 2.7.4 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data via the render...

PT-2024-16125 · WordPress · Arconix Shortcodes

Name of the Vulnerable Software and Affected Versions: Arconix Shortcodes plugin for WordPress versions up to, and including, 2.1.13 Description: The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode due to insufficient input...

CVE-2024-10402

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-leve...

CVE-2024-10117

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfdonate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10357

CVE-2024-10357 affects the Clever Addons for Elementor WordPress plugin (cafe-lite) up to version 2.2.1. The vulnerability allows authenticated attackers with Contributor+ privileges to leak sensitive template data (private, pending, and draft) via getTemplateContent in src/widgets/class-clever-w...

CVE-2024-9967

The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's showmore shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9967

CVE-2024-9967 corresponds to the WordPress WP show more plugin vulnerability: Stored Cross-Site Scripting via the show_more shortcode in all versions up to 1.0.7. Attack requires authenticated access at contributor level or higher, and the exploit could cause script execution on pages loaded by u...

CVE-2024-10091

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10091 ElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-16019 · WordPress · Elementskit Elementor Addons Plugin

Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor addons plugin for WordPress versions up to, and including, 3.2.9 Description: The issue is related to Stored Cross-Site Scripting via the Image Comparison Widget due to insufficient input sanitization and output escaping...

PT-2024-39965 · WordPress · Wp Show More

Name of the Vulnerable Software and Affected Versions: WP show more plugin for WordPress versions up to, and including, 1.0.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's show more shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16039 · WordPress · Wp Crowdfunding

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding plugin for WordPress versions up to, and including, 2.1.11 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wpcf donate shortcode. This allows...

WordPress WP Crowdfunding plugin <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Crowdfunding versions = 2.1.11...

WordPress Clever Addons for Elementor plugin <= 2.2.1 - Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Ankit Patel in WordPress Plugin Clever Addons for Elementor versions = 2.2.1...