CVE-2024-9655

CVE-2024-9655 affects Gutenberg Blocks with AI by Kadence WP – Page Builder Features (WordPress). It is a Stored Cross-Site Scripting via the Icon widget in all versions

CVE-2024-9655: Improper Neutralization of Input During Web Page Generation

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

CVE-2024-6480 SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site Scripting

The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noofreviews' attribute in the woocommercereviews shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-9446

The WP Simple Anchors Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpanchor shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-6480: Improper Neutralization of Special Elements used in an SQL Command

The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noofreviews' attribute in the woocommercereviews shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-9446: Improper Neutralization of Input During Web Page Generation

The WP Simple Anchors Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpanchor shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10223

CVE-2024-10223 affects the WP Team – WordPress Team Member Plugin up to version 1.1.4. The vulnerability is a Stored Cross-Site Scripting (XSS) via the htteamember shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It requires authenticated access at...

CVE-2024-8627

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-8627 Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-9885 Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, and including, 0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-8627 Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-9885

The CVE-2024-9885 entry covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin Widget or Sidebar Shortcode, exploitable via the plugin’s sidebar shortcode in all versions up to 0.6.1. Authenticated attackers with contributor-level access or higher can inject scripts that execu...

CVE-2024-9884: Improper Neutralization of Input During Web Page Generation

The T- Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-39141

Name of the Vulnerable Software and Affected Versions: The Ultimate TinyMCE plugin for WordPress versions up to, and including, 5.7 Description: The issue is related to Stored Cross-Site Scripting via the 'field' shortcode due to insufficient input sanitization and output escaping. This allows...

CVE-2024-9886: Improper Neutralization of Input During Web Page Generation

The WP Baidu Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'baidumap' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-8627: Improper Neutralization of Input During Web Page Generation

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-10226

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10226

CVE-2024-10226 : Arconix Shortcodes for WordPress is vulnerable to Stored XSS via the box shortcode in versions ≤ 2.1.13 due to insufficient input sanitization and output escaping on user attributes. Exploitation requires authenticated access at contributor level or higher; injected scripts execu...

CVE-2024-9505

CVE-2024-9505 affects Beaver Builder – WordPress Page Builder (Plugin). The issue is a stored DOM-based XSS in the Button widget introduced by insufficient input sanitization and output escaping on user-supplied attributes, exploitable by authenticated attackers with contributor-level access and ...

CVE-2024-9505 Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...