CVE-2024-3954

CVE-2024-3954 affects the Ditty WordPress plugin (Ditty – Responsive News Tickers, Sliders, and Lists) for all versions up to 3.1.38. Root cause: PHP Object Injection via deserialization of untrusted input when adding a new ditty. Exploitation requires authenticated access at contributor level or...

CVE-2024-3989 HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery Justify Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-29642

Name of the Vulnerable Software and Affected Versions Testimonial Slider plugin for WordPress versions up to, and including, 1.3.2 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the testimonialcategory shortcode. This allows...

PT-2024-31158

Name of the Vulnerable Software and Affected Versions Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More plugin for WordPress versions up to, and including, 3.7.1 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and outpu...

PT-2024-31721

Name of the Vulnerable Software and Affected Versions: Themify Shortcodes plugin for WordPress versions up to and including 2.0.9 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the themify button shortcode. This allows...

PT-2024-27886

Name of the Vulnerable Software and Affected Versions The Porto Theme - Functionality plugin for WordPress versions prior to 3.0.10 Description The issue allows authenticated attackers with contributor-level and above permissions to include and execute arbitrary files on the server via the...

PT-2024-18071

Name of the Vulnerable Software and Affected Versions The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress versions up to, and including, 4.1.6 Description The issue allows authenticated attackers with contributor-level access and above to perform Server-Si...

Gutenberg Blocks with AI by Kadence WP – Page Builder Features < 3.2.20 - Contributor+ Server-Side Request Forgery

Description The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.19. This makes it possible for authenticated attackers, with contributor-level access and above, to make web...

CVE-2024-4281 Link Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-3494 Mesmerize Companion <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode

The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-3494

CVE-2024-3494 concerns the Mesmerize Companion WordPress plugin. It enables Stored XSS via the mesmerize_contact_form shortcode in all versions up to 1.6.148, caused by insufficient input sanitization and output escaping on user-supplied shortcode attributes. The vulnerability permits an authenti...

CVE-2024-3494: Improper Neutralization of Input During Web Page Generation

The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Giphypress <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Giphypress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

Mini Loops <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Mini Loops plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

GWP-Histats <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The GWP-Histats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Print-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inje...

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.27 - Authenticated (Contributor+) PHP Object Injection

Description The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.26 via deserialization of untrusted input. This makes it possible for authenticated...

Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and abov...

The Plus Addons for Elementor < 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate

Description The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate widget in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Post Grid Master <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.4.8 due to insufficient input...