CVE-2024-4706

CVE-2024-4706 affects WordPress + Microsoft Office 365 / Azure AD | LOGIN (wpo365-login). It enables Stored XSS via the pintra shortcode in all versions up to 27.2 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with contributor+ a...

CVE-2024-4043

The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpupg-text' shortcode in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4043 WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode

The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpupg-text' shortcode in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4043

CVE-2024-4043 pertains to the WordPress plugin WP Ultimate Post Grid . The issue is a Stored Cross-Site Scripting (XSS) in the plugin’s 'wpupg-text' shortcode , affecting all versions up to and including 3.9.1. The root cause is insufficient input sanitization and output escaping on user-supplied...

CVE-2024-3648

CVE-2024-3648 (ShareThis Share Buttons for WordPress) is a Stored XSS vulnerability in the sharethis-inline-button shortcode, affecting all versions up to 2.3.0. The issue allows authenticated users with contributor+ privileges to inject scripts that run when users visit injected pages. Wordfence...

CVE-2024-5177

CVE-2024-5177 — Hash Elements (WordPress) : A stored XSS vulnerability via the url parameter in multiple widgets affects all versions up to 1.3.8. Exploitation requires authenticated access (contributor+). Wordfence notes the patch status as Patched; remediation is to apply the update where avail...

CVE-2024-4431 LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.3.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4431 LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.3.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4431

CVE-2024-4431 affects the LA-Studio Element Kit for Elementor plugin for WordPress. It is a Stored Cross‑Site Scripting (XSS) vulnerability in the id parameter present in all versions up to 1.3.7.6, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated...

CVE-2024-3201 WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pplink' shortcode in all versions up to, and including, 3.1.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-3201

CVE-2024-3201 affects the WP DSGVO Tools (GDPR) WordPress plugin and enables Stored XSS via the plugin’s pp_link shortcode due to insufficient input sanitization and output escaping for user-supplied attributes. Affected versions are all up to and including 3.1.32. Exploitation requires authentic...

CVE-2023-6844 iframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to and including 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-6844

CVE-2023-6844 affects the iframe WordPress plugin (all versions up to 5.0) and is a Stored Cross-Site Scripting vulnerability via shortcode attributes. The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level permissions to...

CVE-2024-4783 jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode

The jQuery T- Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4783 jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode

The jQuery T- Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4486 Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget

The Awesome Contact Form7 for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'AEP Contact Form 7' widget in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-4486: Improper Neutralization of Input During Web Page Generation

The Awesome Contact Form7 for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'AEP Contact Form 7' widget in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

ProfilePress < 4.15.9 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

Spectra – WordPress Gutenberg Blocks < 2.12.9 - Contributor+ Stored XSS via Testimonial Block

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial and Image Gallery blocks due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and...

Spectra – WordPress Gutenberg Blocks < 2.12.9 - Contributor+ Stored XSS via Image Gallery Block

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Image Gallery block due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...