CVE-2024-12335

CVE-2024-12335 concerns the Avada (Fusion) Builder for WordPress. The issue allows information disclosure via handle_clone_post and the fusion_blog shortcode, due to insufficient restrictions on which posts can be included. Affected versions are all up to and including 3.11.12. The vulnerability ...

CVE-2024-11726

The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter of the 'bookingpressform' shortcode in all versions up to, and including, 1.1.21 due to insufficient escaping on the user supplied paramete...

CVE-2024-12591 MagicPost <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode

The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wbsharesocial shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11196

CVE-2024-11196 affects the Multi-column Tag Map plugin for WordPress up to version 17.0.33, allowing Stored XSS in the mctagmap shortcode attributes via insufficient input sanitization and escaping. Exploitation requires authenticated access (Contributor+), and scripts run when pages with injecte...

CVE-2024-12506

The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-12506

The connected Red Hat and Wordfence entries confirm CVE-2024-12506 affects the NACC WordPress Plugin (WordPress) via a Stored Cross-Site Scripting flaw in the nacc shortcode, exploitable on all versions up to 4.1.0 due to insufficient input sanitization and output escaping on user-supplied attrib...

CVE-2024-11774

CVE-2024-11774 affects the Outdooractive Embed WordPress plugin. The vulnerability is a Stored XSS in the list2go shortcode, exploitable by authenticated users with Contributor+ privileges to inject scripts on pages viewed by others. Affected: Outdooractive Embed, versions up to and including 1.5...

CVE-2024-11783

CVE-2024-11783 : The Financial Calculator WordPress plugin is vulnerable to stored XSS via the plugin shortcode finance_calculator in all versions up to 2.2.1. Authenticated users with Contributor+ privileges can inject scripts that execute when other users load affected pages. Connected Red Hat ...

CVE-2024-12560

The CVE refers to Button Block – Get fully customizable & multi-functional buttons (WordPress plugin) with a vulnerability in the btn_block_duplicate_post function affecting all versions up to 1.1.5. The issue enables Sensitive Information Exposure/escalation for authenticated attackers with Cont...

CVE-2024-12560 Button Block – Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication

The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btnblockduplicatepost' function. This makes it possible for authenticated attackers, with Contributor-leve...

CVE-2024-12449

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperplayerhtml' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-12513 Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RFCONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12500 Philantro – Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-8326 s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'scgetdetails' function. This makes it possible for...

CVE-2024-11905

The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11906

The TPG Get Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpggetposts' shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11900 Portfolio – Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'portfolio-pro' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user suppli...

CVE-2024-12443

The CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'crm-perks-tickets' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on...

CVE-2024-12459

The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and including, 0.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10690 Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure

The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODEELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...