CVE-2024-11440: Improper Neutralization of Input During Web Page Generation

The Grey Owl Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'golbutton' shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

PT-2024-16544

Name of the Vulnerable Software and Affected Versions The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress versions up to, and including, 3.3.3 Description The issue is related to Stored Cross-Site Scripting via the 'Countdown' widget due to insufficient input...

CVE-2024-10785: Improper Neutralization of Input During Web Page Generation

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-16948

Name of the Vulnerable Software and Affected Versions Control horas plugin for WordPress versions up to, and including, 1.0.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'ch registro' shortcode due to insufficient input sanitization and output escaping on user...

CVE-2024-10782: Authorization Bypass Through User-Controlled Key

The Theme Builder For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-10316: Exposure of Sensitive Information to an Unauthorized Actor

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/templates/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...

CVE-2024-9542: Exposure of Sensitive Information to an Unauthorized Actor

The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render function in modules/content-switcher/widgets/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-leve...

CVE-2024-11428: Improper Neutralization of Input During Web Page Generation

The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-10872

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template-post-custom-field block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-10872 Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template-post-custom-field block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-10891

The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saveaspdfpdfcrowd' shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10365

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tpcarouselanything.php,...

CVE-2024-10365 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tpcarouselanything.php,...

CVE-2024-10855 Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirvuploadfilebychunks function and lack of in all versions up to, and including...

CVE-2024-10855 Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirvuploadfilebychunks function and lack of in all versions up to, and including...

PT-2024-16972

Name of the Vulnerable Software and Affected Versions RecipePress Reloaded plugin for WordPress versions up to, and including, 2.12.0 Description The issue is related to Stored Cross-Site Scripting via Recipe Ingredients due to insufficient input sanitization and output escaping. This allows...

PT-2024-16077

Name of the Vulnerable Software and Affected Versions The Premium Packages – Sell Digital Products Securely plugin for WordPress versions up to, and including, 5.9.3 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on...

PT-2024-16988

Name of the Vulnerable Software and Affected Versions SuevaFree Essential Kit plugin for WordPress versions up to, and including, 1.1.3 Description The issue is related to Stored Cross-Site Scripting in the plugin's 'counter' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16630

Name of the Vulnerable Software and Affected Versions Contact Form 7 Email Add on plugin for WordPress versions up to, and including, 1.9 Description The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary PHP files on the server. This is...

PT-2024-16980

Name of the Vulnerable Software and Affected Versions Slick Sitemap plugin for WordPress versions up to, and including, 2.0.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'slick-sitemap' shortcode due to insufficient input sanitization and output escaping on...