CVE-2024-1940

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and including, 2.4.41 due to insufficient input sanitization performed only on the client side and insufficient output escaping. This makes it possible for...

PT-2024-31899 · WordPress · The Sellkit

Name of the Vulnerable Software and Affected Versions: The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress versions up to, and including, 1.9.8 Description: The issue is related to Stored Cross-Site Scripting via the id parameter due to...

PT-2024-19901 · WordPress · Clever Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Clever Addons for Elementor plugin for WordPress versions up to, and including, 2.1.9 Description: The issue is related to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets due to insufficient input...

PT-2024-35136 · WordPress · The Easy Social Like Box – Popup – Sidebar Widget

Name of the Vulnerable Software and Affected Versions: The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress versions up to, and including, 4.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'cardoza facebook like box' shortcode due to...

PT-2024-35734 · WordPress · Simple Image Popup Shortcode

Name of the Vulnerable Software and Affected Versions: The Simple Image Popup Shortcode plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'sips popup' shortcode due to insufficient input sanitization and outpu...

PT-2024-32374 · WordPress · Testimonials Widget

Name of the Vulnerable Software and Affected Versions: Testimonials Widget plugin for WordPress versions up to, and including, 4.0.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's testimonials shortcode due to insufficient input sanitization and output escaping ...

PT-2024-17136 · WordPress · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy – Page Builder plugin for WordPress versions up to, and including, 2.4.43 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks due to insufficient input sanitization and output...

PT-2024-31192 · WordPress · Themesflat Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Themesflat Addons For Elementor plugin for WordPress versions up to, and including, 2.1.1 Description: The issue is related to Stored Cross-Site Scripting in several widgets via URL parameters due to insufficient input sanitization and output...

PT-2024-34683 · WordPress · Elementsready Addons For Elementor

Name of the Vulnerable Software and Affected Versions: ElementsReady Addons for Elementor plugin for WordPress versions up to, and including, 6.1.0 Description: The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. Thi...

Magical Addons For Elementor < 1.1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.1.39 due to insufficient input sanitization and...

Colibri Page Builder < 1.0.277 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-33849 · WordPress · Image Hover Effects For Elementor With Lightbox/Flipbox

Name of the Vulnerable Software and Affected Versions: Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress versions up to, and including, 3.0.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping...

Clever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets

Description The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2024-30607 · WordPress · Qi Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Qi Addons For Elementor plugin for WordPress versions up to, and including, 1.7.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's button widgets due to insufficient input sanitization and output escaping on...

PT-2024-32387 · WordPress · Materialis Companion

Name of the Vulnerable Software and Affected Versions: Materialis Companion plugin for WordPress versions up to, and including, 1.3.41 Description: The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis contact form shortcode due to...

PT-2024-34624 · WordPress · Rotating Tweets

Name of the Vulnerable Software and Affected Versions: Rotating Tweets plugin for WordPress versions up to, and including, 1.9.10 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'rotatingtweets' due to insufficient input sanitization and output escaping on...

CVE-2024-4637

The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping on the user supplied Elementor 'wrapperid' and 'zindex' display attributes. This makes it possible for...

CVE-2024-4273

The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'erepropertymap' shortcode in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2019

The WP-DB-Table-Editor plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to lack of a default capability requirement on the 'dbterender' function in all versions up to, and including, 1.8.4. This makes it possible for authenticated...

Brizy – Page Builder < 2.4.44 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL

Description The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...