CVE-2024-4710: Improper Neutralization of Input During Web Page Generation

The UberMenu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ubermenu-col, ubermenumobileclosebutton, ubermenutoggle, ubermenu-search shortcodes in all versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user suppli...

CVE-2024-4943: Improper Neutralization of Input During Web Page Generation

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hasfieldlinkrel’ parameter in all versions up to, and including, 2.0.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

ShopLentor < 2.8.9 - Contributor+ Stored XSS via woolentorsearch Shortcode

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's woolentorsearch shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Page Builder by SiteOrigin < 2.29.16 - Contributor+ Stored XSS via siteorigin_widget Shortcode

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Uber Menu < 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

Description The UberMenu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ubermenu-col, ubermenumobileclosebutton, ubermenutoggle, ubermenu-search shortcodes in all versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on...

CVE-2024-5088

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2024-5088

CVE-2024-5088 affects Happy Addons for Elementor (WordPress) and is a Stored XSS via the _id parameter in all versions up to 3.10.8. Exploitation requires authentication at Contributor level or higher, enabling an attacker to inject scripts that execute on pages accessed by other users. Patch/mit...

CVE-2024-4432

CVE-2024-4432 affects Piotnet Addons For Elementor for WordPress. It is a stored XSS via widget attributes, affecting versions up to 2.4.26 due to insufficient input sanitization/output escaping. Exploitation requires authenticated access at contributor level or higher and enables injection of sc...

CVE-2024-3811

The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'icon' shortcode in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-3811

The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the icon shortcode in all versions up to and including 1.5.3 due to insufficient input sanitization and output escaping on user-supplied attributes. Authentication at contributor level or higher is requir...

CVE-2024-4849 WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter

The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 3.94.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4849

CVE-2024-4849 (WordPress Automatic Plugin) is a Stored XSS in the WordPress Automatic Plugin for WordPress, affecting all versions up to 3.94.0 due to insufficient input sanitization and output escaping in the autoplay parameter. Exploitation requires authenticated access at Contributor level or ...

CVE-2024-3714

CVE-2024-3714 affects the GiveWP – Donation Plugin and Fundraising Platform for WordPress. It is a Stored XSS via the plugin’s give_form shortcode when used with a legacy form in all versions up to and including 3.10.0, caused by insufficient input sanitization and output escaping on user-supplie...

CVE-2024-3714 GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giveform' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on use...

CVE-2024-4374

CVE-2024-4374 affects the DethemeKit For Elementor WordPress plugin. A Stored XSS exists in widget attributes due to insufficient input sanitization and output escaping, enabling an authenticated attacker with contributor-level access or higher to inject scripts that run when users load injected ...

CVE-2024-4865

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2024-4865 Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2024-4432: Improper Neutralization of Input During Web Page Generation

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.4.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-4849: Improper Neutralization of Input During Web Page Generation

The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 3.94.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-5088: Improper Neutralization of Input During Web Page Generation

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...