PT-2024-31936

Name of the Vulnerable Software and Affected Versions JetWidgets For Elementor plugin for WordPress versions up to, and including, 1.0.17 Description The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above...

PT-2024-34703

Name of the Vulnerable Software and Affected Versions Flatsome theme for WordPress versions up to, and including, 3.18.7 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-34166

Name of the Vulnerable Software and Affected Versions: The Sina Extension for Elementor plugin for WordPress versions up to, and including, 3.5.4 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the url...

CVE-2024-5574

The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files ...

CVE-2024-5853 Image Optimizer, Resizer and CDN – Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirvuploadfilebychanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with...

CVE-2024-5574 WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion

The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files ...

CVE-2024-5574 WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion

The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files ...

CVE-2024-5574

CVE-2024-5574 affects WP Magazine Modules Lite for WordPress (all versions up to 1.1.2). The vulnerability is Local File Inclusion via the blockLayout parameter, enabling authenticated users with Contributor-level access or higher to include and execute arbitrary PHP files on the server, potentia...

CVE-2024-5724

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-4623

The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘paginationstyle’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2024-4623 Blogmentor – Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter

The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘paginationstyle’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2024-5649

The CVE-2024-5649 entry concerns Universal Slider (fusion-slider) for WordPress, affected up to version 1.6.5. It describes PHP Object Injection via deserialization of untrusted input in the fsl_get_gallery_value function. The advisory states that authenticated attackers with Contributor-level ac...

CVE-2024-5724 Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-5724

CVE-2024-5724 affects the Photo Video Gallery Master plugin for WordPress (up to v1.5.3). It exposes PHP Object Injection via deserialization of the PVGM_all_photos_details parameter, exploitable by authenticated users with Contributor+ access. The advisory notes that there is no known POP chain ...

CVE-2024-3984

The CVE CVE-2024-3984 affects the EmbedSocial – Social Media Feeds, Reviews and Galleries WordPress plugin (up to version 1.1.29). The issue is Stored XSS via the plugin shortcode embedsocial_reviews due to insufficient input sanitization and output escaping on user-supplied attributes. Impact is...

PT-2024-31926

Name of the Vulnerable Software and Affected Versions The Blogmentor – Blog Layouts for Elementor plugin for WordPress versions up to, and including, 1.5 Description The issue is related to Stored Cross-Site Scripting via the pagination style parameter due to insufficient input sanitization and...

CVE-2024-4623: Improper Neutralization of Input During Web Page Generation

The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘paginationstyle’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2024-3984: Improper Neutralization of Input During Web Page Generation

The EmbedSocial – Social Media Feeds, Reviews and Galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedsocialreviews' shortcode in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-5649: Deserialization of Untrusted Data

The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted input 'fslgetgalleryvalue' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ...

PT-2024-28695

Name of the Vulnerable Software and Affected Versions EmbedSocial – Social Media Feeds, Reviews and Galleries plugin for WordPress versions up to, and including, 1.1.29 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'embedsocial reviews' shortcode due to...