CVE-2024-9897: Improper Neutralization of Input During Web Page Generation

The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-twitch-embed shortcode in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-9889: Exposure of Sensitive Information to an Unauthorized Actor

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.9 via the Page Loader widget. This makes it possible for authenticated attackers, with contributor-level access and above, to view...

CVE-2024-9425 Advanced Category and Custom Taxonomy Image <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode

The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adtaximage shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10057 RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode

The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10055

CVE-2024-10055 affects the WordPress plugin Click to Chat – WP Support All-in-One Floating Widget. It enables Stored Cross-Site Scripting via the wpsaio_snapchat shortcode in all versions up to and including 2.3.3. The vulnerability requires at least contributor-level authentication and allows an...

CVE-2024-10080 WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10014

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-10014

CVE-2024-10014 – Flat UI Button (WordPress) XSS Affected: Flat UI Button plugin for WordPress, version 1.0 and earlier. Root cause: Insufficient input sanitization and output escaping on user-supplied attributes within the flatbtn shortcode. Impact: Stored Cross‑Site Scripting that can execute ar...

CVE-2024-10057: Improper Neutralization of Input During Web Page Generation

The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-15999

Name of the Vulnerable Software and Affected Versions Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress versions up to, and including, 2.3.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's wpsaio snapchat shortcode due to insufficient inpu...

CVE-2024-10080: Improper Neutralization of Input During Web Page Generation

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10014: Improper Neutralization of Input During Web Page Generation

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-9425: Improper Neutralization of Input During Web Page Generation

The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adtaximage shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10055: Improper Neutralization of Input During Web Page Generation

The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaiosnapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-9898

The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-15974

Name of the Vulnerable Software and Affected Versions Flat UI Button plugin for WordPress version 1.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's flatbtn shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This...

CVE-2024-9898: Improper Neutralization of Input During Web Page Generation

The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9540

CVE-2024-9540 affects the WordPress plugin “Sina Extension for Elementor” (versions up to and including 3.5.7). The vulnerability arises in the render function of widgets/advanced/sina-modal-box.php, enabling authenticated attackers with Contributor-level access or higher to expose sensitive Elem...

CVE-2024-9582

CVE-2024-9582 : Accordion Slider (WordPress)

CVE-2021-4450 Post Grid <= 2.1.12 - Contributor+ SQL Injection

The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...