CVE-2024-5799: Improper Neutralization of Input During Web Page Generation

The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as Contributors to perform Cross-Site Scripting attacks...

CVE-2024-8045

The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-8045

CVE-2024-8045 affects the Advanced WordPress Backgrounds plugin for WordPress, vulnerable to Stored Cross-Site Scripting via the imageTag parameter in all versions up to and including 1.12.3. The root cause is insufficient input sanitization and output escaping, allowing authenticated attackers w...

CVE-2024-8045: Improper Neutralization of Input During Web Page Generation

The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-8440: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output...

CVE-2024-6282 Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Element

The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-jltma-wrapper-link element in all versions up to, and including 2.0.6.4 due to insufficient input sanitization and output...

CVE-2024-8543 Slider comparison image before and after <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sciba shortcode in all versions up to, and including, 0.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2024-8241 Nova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute

The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress Slider comparison image before and after plugin <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Krzysztof Zając in WordPress Plugin Slider comparison image before and after versions = 0.8.3...

PT-2024-38886

Name of the Vulnerable Software and Affected Versions: Nova Blocks by Pixelgrade plugin for WordPress versions up to, and including, 2.1.7 Description: The issue is related to Stored Cross-Site Scripting via the align attribute of the wp:separator Gutenberg block due to insufficient input...

CVE-2024-8241: Improper Neutralization of Input During Web Page Generation

The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-8543: Improper Neutralization of Input During Web Page Generation

The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sciba shortcode in all versions up to, and including, 0.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2024-7599

The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermonvideoembed’ parameter in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-7611

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-7611 Enter Addons – Ultimate Template Builder for Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-7611 Enter Addons – Ultimate Template Builder for Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-7599 Advanced Sermons <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermonvideoembed’ parameter in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-8317

CVE-2024-8317 concerns the WordPress plugin WP AdCenter – Ad Manager & Adsense Ads. The vulnerability is a stored cross-site scripting (XSS) via the ad_alignment attribute affecting all versions up to and including 2.5.6. Exploitation requires authenticated access at Contributor level or higher, ...

CVE-2024-8480

CVE-2024-8480 affects the WordPress plugin “Image Optimizer, Resizer and CDN – Sirv” up to version 7.2.7. The root cause is a missing capability check in sirv_save_prevented_sizes, allowing authenticated users with Contributor+ access to trigger sirv_upload_file_by_chunks_callback with insufficie...

PT-2024-38440

Name of the Vulnerable Software and Affected Versions Advanced Sermons plugin for WordPress versions up to, and including, 3.3 Description The issue is related to Stored Cross-Site Scripting via the sermon video embed parameter due to insufficient input sanitization and output escaping. This allo...