PT-2024-37511

Name of the Vulnerable Software and Affected Versions: DethemeKit For Elementor plugin for WordPress versions up to and including 2.1.5 Description: The issue is related to Stored Cross-Site Scripting via the URL parameter of the De Gallery widget due to insufficient input sanitization and output...

PT-2024-31730

Name of the Vulnerable Software and Affected Versions: Elementor Addon Elements plugin for WordPress versions up to, and including, 1.13.5 Description: The issue is related to Stored Cross-Site Scripting via the url parameter due to insufficient input sanitization and output escaping. This allows...

PT-2024-37492

Name of the Vulnerable Software and Affected Versions: The Portfolio Gallery – Image Gallery Plugin plugin for WordPress versions up to, and including, 1.6.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'PFG'...

CVE-2024-5601: Improper Neutralization of Input During Web Page Generation

The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-33698

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor versions up to, and including, 5.6.0 Description: The issue is related to Stored Cross-Site Scripting via the video color parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-4570: Improper Neutralization of Input During Web Page Generation

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2024-36663

Name of the Vulnerable Software and Affected Versions Create by Mediavine plugin for WordPress versions up to, and including, 1.9.7 Description The issue is related to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-6054: Unrestricted Upload of File with Dangerous Type

The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'createpostattachmentfromurl' function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with contributor-level and above...

CVE-2024-4569: Improper Neutralization of Input During Web Page Generation

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-6283: Improper Neutralization of Input During Web Page Generation

The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL parameter of the De Gallery widget in all versions up to and including 2.1.5 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible fo...

PT-2024-31728

Name of the Vulnerable Software and Affected Versions: Elementor Addon Elements plugin for WordPress versions up to, and including, 1.13.5 Description: The issue is related to Stored Cross-Site Scripting via the url parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-5332

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5332 Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5332

CVE-2024-5332 affects Exclusive Addons for Elementor (WordPress). It is a Stored XSS in the Card Widget up to version 2.6.9.8 caused by insufficient input sanitization and output escaping. Exploitation requiresContributor+ access; attacker can inject scripts on pages, executed when users view the...

CVE-2024-5173: Improper Neutralization of Input During Web Page Generation

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-5215: Improper Neutralization of Input During Web Page Generation

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-34871

Name of the Vulnerable Software and Affected Versions HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.5.5 Description The issue is related to Stored Cross-Site Scripting via the Video player widget settings due to insufficient input sanitization and...

PT-2024-35127

Name of the Vulnerable Software and Affected Versions HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.5.5 Description The issue is related to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and output escaping o...

CVE-2024-5332: Improper Neutralization of Input During Web Page Generation

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-35722

Name of the Vulnerable Software and Affected Versions Exclusive Addons for Elementor plugin for WordPress versions up to, and including, 2.6.9.8 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's Card widget, allowing...