CVE-2024-4275

CVE-2024-4275 affects the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders. The Stored XSS vulnerability is in the Interactive Circle widget due to insufficient input sanitization and output escaping on user-supplied attributes, allo...

WordPress Extra theme <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Theme Extra versions = 4.25.0...

WordPress Divi theme <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Theme Divi versions = 4.25.0...

Beaver Builder < 2.8.1.3 - Contributor+ Stored Cross-Site Scripting via photo widget crop attribute

Description The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attribute in all versions up to, and including, 2.8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-30140 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.5 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the layout html parameter...

PT-2024-23479 · WordPress · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: The Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.102 Description: The issue allows authenticated attackers with contributor access or higher to perform time-based SQL Injection via the id parameter...

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) < 1.5.105 - Contributor+ SQL Injection

Description The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.102 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-4567 Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-0445

CVE-2024-0445 concerns WordPress plugin The Plus Addons for Elementor Page Builder. Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to 5.4.2, caused by insufficient input sanitization and output escaping in the plugin’s element attributes. Exploitati...

CVE-2024-0445 The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's element attributes in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with...

CVE-2024-3923

Technical details about CVE-2024-3923 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories to obtain affected versions, impact, and fixes.

CVE-2024-3923 Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the linktarget parameter in all versions up to, and including, 2.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-4339

CVE-2024-4339 is a Stored Cross-Site Scripting vulnerability in the Prime Slider – Addons For Elementor plugin (bdthemes-prime-slider-lite) for WordPress. The issue affects all versions up to 3.14.3 and is caused by insufficient input sanitization and output escaping in the General widget, allowi...

CVE-2024-3831 Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-3831

CVE-2024-3831 (Enter Addons – Ultimate Template Builder for Elementor) : The WordPress plugin is vulnerable to a Stored Cross-Site Scripting (XSS) in the Heading widget across all versions up to 2.1.5 due to insufficient input sanitization and output escaping. Exploitation requires authentication...

CVE-2024-3680 Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's img tag in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-3680

CVE-2024-3680 affects the WordPress plugin Enter Addons – Ultimate Template Builder for Elementor. It is a Stored XSS via the Animation Title widget img tag in all versions up to 2.1.5, requiring authenticated access with Contributor or higher. The vulnerability allows injecting arbitrary scripts...

PT-2024-15566 · WordPress · The Plus Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor plugin for WordPress versions up to, and including, 5.4.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the plugin's element...

PT-2024-30691 · WordPress · Simple Membership

Name of the Vulnerable Software and Affected Versions: Simple Membership plugin for WordPress versions up to, and including, 4.4.5 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the swpm paypal subscription cancel link...

PT-2024-28711 · WordPress · Ht Mega – Absolute Addons For Elementor

Name of the Vulnerable Software and Affected Versions: HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.5.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Gallery Justify Widget due to insufficient input sanitization...