PT-2023-31760

Name of the Vulnerable Software and Affected Versions WP Mailto Links – Protect Email Addresses plugin for WordPress versions up to, and including, 3.1.3 Description The issue is related to Stored Cross-Site Scripting via the wpml mailto shortcode due to insufficient input sanitization and output...

PT-2023-31960

Name of the Vulnerable Software and Affected Versions Magic Action Box plugin for WordPress versions up to, and including, 2.17.2 Description The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes...

CVE-2023-5086: Improper Neutralization of Input During Web Page Generation

The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-4598: Improper Neutralization of Special Elements used in an SQL Command

The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5292: Improper Neutralization of Input During Web Page Generation

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfeform' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5071: Improper Neutralization of Input During Web Page Generation

The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekitiframe' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above...

CVE-2023-5615: Improper Neutralization of Input During Web Page Generation

The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5618: Improper Neutralization of Input During Web Page Generation

The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

PT-2023-31692

Name of the Vulnerable Software and Affected Versions Copy Anything to Clipboard plugin for WordPress versions up to, and including, 2.6.4 Description The issue is related to Stored Cross-Site Scripting via the 'copy' shortcode due to insufficient input sanitization and output escaping on...

CVE-2023-5614: Improper Neutralization of Input During Web Page Generation

The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themeswitchalist' shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5337: Improper Neutralization of Input During Web Page Generation

The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...

CVE-2023-5639 Team Showcase <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2023-31107

Name of the Vulnerable Software and Affected Versions iframe plugin for WordPress versions up to, and including, 4.6 Description The issue is related to Stored Cross-Site Scripting via the iframe shortcode due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2023-31907

Name of the Vulnerable Software and Affected Versions flowpaper plugin for WordPress versions up to, and including, 2.0.3 Description The issue is related to Stored Cross-Site Scripting via the flipbook shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-31616

Name of the Vulnerable Software and Affected Versions Sitekit plugin for WordPress versions up to, and including, 1.4 Description The issue is related to Stored Cross-Site Scripting via the sitekit iframe shortcode due to insufficient input sanitization and output escaping. This allows...

CVE-2023-5639: Improper Neutralization of Input During Web Page Generation

The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-5638: Improper Neutralization of Input During Web Page Generation

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcjimage' shortcode in versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-5336: Improper Neutralization of Special Elements used in an SQL Command

The iPanorama 360 – WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2023-45049: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Ciprian Popescu YouTube Playlist Player plugin = 4.6.7 versions...

CVE-2023-31217: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in MyTechTalky User Location and IP plugin = 1.6 versions...