PT-2024-17326

Name of the Vulnerable Software and Affected Versions Perfect Font Awesome Integration plugin for WordPress versions up to and including 2.3 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'pfai' shortcode. This...

PT-2024-16382

Name of the Vulnerable Software and Affected Versions Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress versions up to, and including, 1.20.2 Description The issue is related to Stored Cross-Site Scripting via the post title...

PT-2024-17253

Name of the Vulnerable Software and Affected Versions Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress versions prior to 4.7 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode due to insufficient input sanitization and output...

PT-2024-16097

Name of the Vulnerable Software and Affected Versions Cognito Forms plugin for WordPress versions up to, and including, 2.0.6 Description The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2024-17344

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress versions up to, and including, 1.9.5 Description The issue is related to Stored Cross-Site Scripting via the attire-blocks/post-carousel block due to insufficient input...

PT-2024-17241

Name of the Vulnerable Software and Affected Versions WordPress Portfolio Plugin versions up to, and including, 1.6.3 Description The WordPress Portfolio Plugin is vulnerable to Stored Cross-Site Scripting via the plugin's gs portfolio shortcode due to insufficient input sanitization and output...

PT-2024-16949

Name of the Vulnerable Software and Affected Versions Arena.IM – Live Blogging for real-time events plugin for WordPress versions up to, and including, 0.3.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode due to insufficient input sanitizati...

PT-2024-16804

Name of the Vulnerable Software and Affected Versions Greenshift – animation and page builder blocks plugin for WordPress versions up to, and including, 9.9.9.3 Description The issue concerns insufficient restrictions on which posts can be included via the wp reusable render shortcode. This allow...

PT-2024-17257

Name of the Vulnerable Software and Affected Versions Integrate Firebase plugin for WordPress versions up to and including 0.9.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'firebase show' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16968

Name of the Vulnerable Software and Affected Versions YooBar plugin for WordPress versions up to, and including, 2.0.6 Description The YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings due to insufficient input sanitization and output escaping. This...

PT-2024-17242

Name of the Vulnerable Software and Affected Versions WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress versions up to, and including, 1.3.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'gs book showcas...

CVE-2024-11765: Improper Neutralization of Input During Web Page Generation

The WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gsportfolio' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization a...

CVE-2024-11750: Improper Neutralization of Input During Web Page Generation

The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11410: Improper Neutralization of Input During Web Page Generation

The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This mak...

CVE-2024-10182: Improper Neutralization of Input During Web Page Generation

The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-11427: Improper Neutralization of Input During Web Page Generation

The Catch Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catch-popup' shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11413: Improper Neutralization of Input During Web Page Generation

The HostFact bestelformulier integratie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bestelformulier' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-11760: Improper Neutralization of Input During Web Page Generation

The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-11181: Authorization Bypass Through User-Controlled Key

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wpreusablerender' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticate...

CVE-2024-11766: Improper Neutralization of Input During Web Page Generation

The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gsbookshowcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output...