CVE-2024-1896 Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode

The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.2 via deserialization via shortcode of untrusted input from the 'awllgsettings'...

CVE-2024-1896

CVE-2024-1896 affects the WordPress plugin Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery. It allows PHP Object Injection via deserialization of untrusted input in the shortcode attribute awl_lg_settings_ for versions up to 1.4.1. An auth...

CVE-2024-1348 Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-3005

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget in all versions up to, and including, 1.3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2024-3280

CVE-2024-3280 : The WordPress plugin Follow Us Badges (wpsite-follow-us-badges) is vulnerable to Stored Cross-Site Scripting via its shortcode, affecting all versions up to 3.1.10. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes, enabling an au...

CVE-2024-3490

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in all versions up to, and including, 9.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3490

CVE-2024-3490 is a Stored Cross-Site Scripting vulnerability in the WordPress plugin WP Recipe Maker, affecting all versions up to and including 9.3.1. It arises from insufficient input sanitization and output escaping on user-supplied attributes in the wprm-recipe-roundup-item shortcode, allowin...

PT-2024-24150 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.4 Description: The issue is related to Stored Cross-Site Scripting via the countdown widget's attributes due to insufficient input sanitization and output escaping. Thi...

PT-2024-18404 · WordPress · The Grid Gallery

Name of the Vulnerable Software and Affected Versions: The Grid Gallery – Photo Image Grid Gallery plugin for WordPress versions up to, and including, 1.4.3 Description: The issue allows authenticated attackers with contributor access and above to inject a PHP Object via deserialization of...

PT-2024-27406 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Image Stack Group, Photo Stack, & Horizontal Timeline widgets due to...

PT-2024-27133 · WordPress · Leaflet Maps Marker

Name of the Vulnerable Software and Affected Versions: Leaflet Maps Marker plugin for WordPress versions up to, and including, 3.12.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes, such as...

PT-2024-18315 · WordPress · Wp Ulike

Name of the Vulnerable Software and Affected Versions: WP ULike – Most Advanced WordPress Marketing Toolkit plugin versions up to, and including, 4.6.9 Description: The issue allows authenticated attackers with contributor-level access and above to perform SQL Injection via the status and id...

PT-2024-19896 · WordPress · Fancy Elementor Flipbox

Name of the Vulnerable Software and Affected Versions: Fancy Elementor Flipbox plugin for WordPress versions up to, and including, 2.4.2 Description: The issue is related to Stored Cross-Site Scripting via the Fancy Elementor Flipbox widget due to insufficient input sanitization and output...

PT-2024-28273 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.5 Description: The issue is related to Stored Cross-Site Scripting via HTML tags in widgets due to insufficient input sanitization and output escaping on...

PT-2024-22511 · WordPress · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress plugin for WordPress versions up to, and including, 4.15.4 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the title parameter. This...

PT-2024-18453 · WordPress · Social Warfare

Name of the Vulnerable Software and Affected Versions: Social Warfare plugin for WordPress versions up to, and including, 4.4.6.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'socialWarfare' shortcode due to insufficient input sanitization and output escaping ...

PT-2024-26241 · WordPress · Wp Recipe Maker

Name of the Vulnerable Software and Affected Versions: WP Recipe Maker plugin for WordPress versions up to, and including, 9.3.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode due to insufficient input sanitization and output...

PT-2024-23610 · WordPress · Elementor Imagebox

Name of the Vulnerable Software and Affected Versions: Elementor ImageBox plugin for WordPress versions up to, and including, 1.2.8 Description: The issue is related to Stored Cross-Site Scripting via the image box widget due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-28809 · WordPress · All-In-One Video Gallery

Name of the Vulnerable Software and Affected Versions: All-in-One Video Gallery plugin for WordPress versions up to, and including, 3.6.4 Description: The issue is related to missing file type validation in the aiovg create attachment from external image url function. This allows authenticated...

PT-2024-26279 · WordPress · Elementskit Elementor Addons

Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor addons plugin for WordPress versions prior to 3.1.1 Description: The issue allows authenticated attackers with contributor-level access and above to include and execute arbitrary files on the server via the generate...