CVE-2024-6824

The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'checktempvalidity' and 'updatetemplatetitle' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticate...

CVE-2024-7150

The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2024-5226

The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and including, 5.4.10 due to insufficient validation of SVG files. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-6824 Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update

The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'checktempvalidity' and 'updatetemplatetitle' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticate...

CVE-2024-7561

The Next theme for WordPress (up to version 1.1.0) is vulnerable to PHP Object Injection through deserialization of untrusted input in the wpeden_post_meta post meta value. Exploitation requires authenticated access at Contributor level or higher. The vulnerability allows injection of a PHP Objec...

PT-2024-38414 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.9.3 Description: The issue is related to time-based SQL Injection via the order parameter due to insufficient escaping on the user-supplied parameter and lack of sufficien...

PT-2024-38112 · 10Web · The Slider By 10Web

Name of the Vulnerable Software and Affected Versions: The Slider by 10Web – Responsive Image Slider plugin for WordPress versions up to, and including, 1.2.57 Description: The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied...

PT-2024-36988 · WordPress · Foobox

Name of the Vulnerable Software and Affected Versions: FooBox plugin for WordPress versions up to, and including, 2.7.28 Description: The issue is related to DOM-based Stored Cross-Site Scripting via HTML data attributes due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-37888 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.38 Description: The issue is related to a missing capability check on the check temp validity and update template title functions. This allows authenticated...

PT-2024-38421 · WordPress · The Next

Name of the Vulnerable Software and Affected Versions: The Next theme for WordPress versions up to, and including, 1.1.0 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input from the wpeden post...

PT-2024-35138 · WordPress · Fuse Social Floating Sidebar

Name of the Vulnerable Software and Affected Versions: Fuse Social Floating Sidebar plugin for WordPress versions up to, and including, 5.4.10 Description: The issue is related to Stored Cross-Site Scripting via the file upload functionality due to insufficient validation of SVG files. This allow...

PT-2024-38377 · WordPress · Multipurpose

Name of the Vulnerable Software and Affected Versions: MultiPurpose theme for WordPress versions up to, and including, 1.2.0 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input through the wped...

PT-2024-38284 · WordPress · Accept Stripe Payments

Name of the Vulnerable Software and Affected Versions: Accept Stripe Payments plugin for WordPress versions up to and including 2.0.86 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the accept stripe payment ng shortcode. This...

CVE-2024-7317

The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-6766

The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...

WordPress Folders plugin <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by wesley wcraft in WordPress Plugin Folders versions = 3.0.3...

PT-2024-38262 · WordPress · The Folders

Name of the Vulnerable Software and Affected Versions: The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress versions up to, and including, 3.0.3 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due t...

WordPress Horizontal scrolling announcements plugin <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode vulnerability

Authenticated Contributor+ SQL Injection via Shortcode vulnerability discovered by István Márton in WordPress Plugin Horizontal scrolling announcements versions = 2.4...

CVE-2024-3827

The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2024-2455

The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget wrapper link URL in all versions up to, and including, 7.9.0 due to insufficient input sanitization and output escaping on user supplied attributes...