CVE-2024-4980

CVE-2024-4980 affects WPKoi Templates for Elementor (WordPress). It is a Stored Cross-Site Scripting flaw in multiple parameters (id, mixColor, backgroundColor, saveInCookies, autoMatchOsTheme) across all versions up to 2.5.9 due to insufficient input sanitization and output escaping. Authenticat...

WordPress Media Library Assistant plugin <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode vulnerability

Authenticated Contributor+ SQL Injection via Shortcode vulnerability discovered by Thanh Nam Tran in WordPress Plugin Media LIbrary Assistant versions = 3.15...

CVE-2024-2163: Improper Neutralization of Input During Web Page Generation

The Ninja Beaver Add-ons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes such as urls. This makes it...

SiteOrigin Widgets Bundle < 1.61.0 - Contributor+ Stored XSS via siteorigin_widget Shortcode

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Element Pack Elementor Addons < 5.6.2 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the customattributes value in widgets due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to...

PT-2024-34131

Name of the Vulnerable Software and Affected Versions: Memberpress plugin for WordPress versions up to, and including, 1.11.29 Description: The issue allows authenticated attackers with Contributor-level access and above to make web requests to arbitrary locations originating from the web...

CVE-2024-30419: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this...

CVE-2024-5031: Server-Side Request Forgery (SSRF)

The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary...

PT-2024-18981

Name of the Vulnerable Software and Affected Versions Ninja Beaver Add-ons for Beaver Builder plugin for WordPress versions up to, and including, 2.4.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's widgets due to insufficient input sanitization and output escapi...

PT-2024-26896

Name of the Vulnerable Software and Affected Versions Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced plugin for WordPress versions up to, and including, 1.4.9 Description The issue is related to Stored Cross-Site Scripting via the plugin's tbex-version shortcode due to...

CVE-2024-3926: Improper Neutralization of Input During Web Page Generation

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customattributes value in widgets in all versions up to, and including, 5.6.1 due to insufficient input sanitization...

PT-2024-15108

Name of the Vulnerable Software and Affected Versions iframe plugin for WordPress versions up to and including 5.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. Th...

CVE-2024-5025: Improper Neutralization of Input During Web Page Generation

The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all versions up to, and including, 1.11.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-4980: Improper Neutralization of Input During Web Page Generation

The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id', 'mixColor', 'backgroundColor', 'saveInCookies', and 'autoMatchOsTheme' parameters in all versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping...

CVE-2024-4362: Improper Neutralization of Input During Web Page Generation

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode in all versions up to, and including, 1.60.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

PT-2024-27135

Name of the Vulnerable Software and Affected Versions Print-O-Matic plugin for WordPress versions up to, and including, 2.1.10 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'print-me' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-3066: Improper Neutralization of Input During Web Page Generation

The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for...

Contact Form Plugin by Fluent Forms < 5.1.16 - Contributor+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additiona...

jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode

Description The jQuery T- Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2024-4809

Name of the Vulnerable Software and Affected Versions: WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress versions up to, and including, 27.2 Description: The issue exists due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's...