CVE-2024-10855 Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirvuploadfilebychunks function and lack of in all versions up to, and including...

PT-2024-16988

Name of the Vulnerable Software and Affected Versions SuevaFree Essential Kit plugin for WordPress versions up to, and including, 1.1.3 Description The issue is related to Stored Cross-Site Scripting in the plugin's 'counter' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16983

Name of the Vulnerable Software and Affected Versions Lazy load videos and sticky control plugin for WordPress versions up to, and including, 3.0.0 Description The issue is related to Stored Cross-Site Scripting in the plugin's 'lazy-load-videos-and-sticky-control' shortcode due to insufficient...

PT-2024-16980

Name of the Vulnerable Software and Affected Versions Slick Sitemap plugin for WordPress versions up to, and including, 2.0.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'slick-sitemap' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16472

Name of the Vulnerable Software and Affected Versions UltraAddons – Elementor Addons plugin for WordPress versions up to, and including, 1.1.8 Description The issue allows authenticated attackers with Contributor-level access and above to expose the contents of draft, private, and pending posts d...

PT-2024-16950

Name of the Vulnerable Software and Affected Versions Pure CSS Circle Progress bar plugin for WordPress versions up to, and including, 1.2 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'circle progress' shortcode due to insufficient input sanitization and output...

CVE-2024-10891: Improper Neutralization of Input During Web Page Generation

The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saveaspdfpdfcrowd' shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10365: Exposure of Sensitive Information to an Unauthorized Actor

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tpcarouselanything.php,...

CVE-2024-10872: Improper Neutralization of Input During Web Page Generation

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template-post-custom-field block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

PT-2024-16077

Name of the Vulnerable Software and Affected Versions The Premium Packages – Sell Digital Products Securely plugin for WordPress versions up to, and including, 5.9.3 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on...

PT-2024-16972

Name of the Vulnerable Software and Affected Versions RecipePress Reloaded plugin for WordPress versions up to, and including, 2.12.0 Description The issue is related to Stored Cross-Site Scripting via Recipe Ingredients due to insufficient input sanitization and output escaping. This allows...

PT-2024-16630

Name of the Vulnerable Software and Affected Versions Contact Form 7 Email Add on plugin for WordPress versions up to, and including, 1.9 Description The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary PHP files on the server. This is...

CVE-2024-11224

The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-11198 GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter

The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘extraclass’ parameter in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-11224

CVE-2024-11224 : The WordPress plugin Parallax Image (

CVE-2024-11224 Parallax Image <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter

The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-11195

The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's printemailsubscribeform shortcode in all versions up to, and including, 1.2.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-11195: Improper Neutralization of Input During Web Page Generation

The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's printemailsubscribeform shortcode in all versions up to, and including, 1.2.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-16839

Name of the Vulnerable Software and Affected Versions Parallax Image plugin for WordPress versions up to, and including, 1.9 Description The issue is related to Stored Cross-Site Scripting via the position parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-11224: Improper Neutralization of Input During Web Page Generation

The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...