CVE-2024-5925

The Theron Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2024-5922 Scylla lite <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

The Scylla lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-5925 Theron Lite <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

The Theron Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2024-5925

CVE-2024-5925 affects the WordPress theme Theron Lite. The issue is a Stored Cross-Site Scripting (XSS) via the url parameter in the theme’s Button shortcode in all versions up to and including 2.0, caused by insufficient input sanitization and output escaping. The vulnerability requires authenti...

CVE-2024-5925 Theron Lite <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

The Theron Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2024-5788

The Silesia theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute within the theme's Button shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-5796

The Infinite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘projecturl’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2024-5796 Infinite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via project_url Parameter

The Infinite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘projecturl’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2024-5788

CVE-2024-5788 concerns the WordPress theme Silesia. The vulnerability is a Stored Cross-Site Scripting (XSS) via the ‘link’ attribute in the theme’s Button shortcode, affecting all versions up to and including 1.0.6. It requires authentication at Contributor level or higher, enabling an attacker ...

CVE-2024-5788 Silesia <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

The Silesia theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute within the theme's Button shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-6296

CVE-2024-6296 affects Stackable – Page Builder Gutenberg Blocks for WordPress. The vulnerability is Stored Cross-Site Scripting via the data-caption parameter in all versions up to 3.13.1, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at...

CVE-2024-6296 Stackable – Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ parameter in all versions up to, and including, 3.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2024-37242

Name of the Vulnerable Software and Affected Versions: Scylla lite theme for WordPress versions up to, and including, 1.8.3 Description: The issue arises from insufficient input sanitization and output escaping in the url parameter within the theme's Button shortcode, allowing authenticated...

PT-2024-37161

Name of the Vulnerable Software and Affected Versions: Infinite theme for WordPress versions up to, and including, 1.1.2 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and above to inject...

PT-2024-37244

Name of the Vulnerable Software and Affected Versions: Theron Lite theme for WordPress versions up to, and including, 2.0 Description: The issue allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages via the url parameter within the theme's...

PT-2024-37519

Name of the Vulnerable Software and Affected Versions: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress versions up to and including 3.13.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically v...

CVE-2024-6296: Improper Neutralization of Input During Web Page Generation

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ parameter in all versions up to, and including, 3.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2024-36928

Name of the Vulnerable Software and Affected Versions The Ultimate Post Kit Addons For Elementor plugin for WordPress versions up to and including 3.11.7 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the url parameter...

PT-2024-36118

Name of the Vulnerable Software and Affected Versions: The Gallery Blocks with Lightbox plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2024-5662: Improper Neutralization of Input During Web Page Generation

The Ultimate Post Kit Addons For Elementor – Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the Social Count Static widget in all versions up to, and...