CVE-2024-9650 WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all versions up to, and including, 9.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2024-9650

CVE-2024-9650 : WP Recipe Maker for WordPress is vulnerable to stored XSS via the tooltip parameter in all versions up to and including 9.6.1. Exploitation requires Contributor-level access or higher. Connected sources confirm the flaw and that patches exist: fixed in 9.7.0. Affected product/vers...

CVE-2024-10050

CVE-2024-10050 affects Elementor Header & Footer Builder for WordPress up to version 1.6.43, enabling information disclosure via the hfe_template shortcode. Authenticated users with Contributor+ can view Draft, Private, and password‑protected posts they do not own. The vulnerability is documented...

CVE-2024-8667

The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign function in all versions up to, and including, 2.10.0. This makes it possible for...

CVE-2024-8667 HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication

The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign function in all versions up to, and including, 2.10.0. This makes it possible for...

CVE-2024-8500

CVE-2024-8500 affects the WordPress plugin “WP Shortcodes Plugin — Shortcodes Ultimate” (versions

CVE-2024-9530

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the...

CVE-2024-9530 Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposure

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the...

CVE-2024-9530 Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposure

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the...

CVE-2024-9530

CVE-2024-9530 concerns the Qi Addons For Elementor WordPress plugin. The vulnerability is a Sensitive Information Exposure affecting all versions up to 1.8.0, exploitable by an authenticated attacker with Contributor-level access and above to exfiltrate data from private templates. Public sources...

CVE-2024-10189

The CVE-2024-10189 entry refers to the Anchor Episodes Index (Spotify for Podcasters) WordPress plugin. A stored XSS vulnerability exists in all versions up to 2.1.10 via the anchor_episodes shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Exploita...

CVE-2024-9541 News Kit Elementor Addons <= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template

The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-9541 News Kit Elementor Addons <= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template

The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-9541

CVE-2024-9541 affects News Kit Elementor Addons for WordPress up to version 1.2.1, where the render function in includes/widgets/canvas-menu/canvas-menu.php exposes sensitive Elementor template data to authenticated users with Contributor-level access or higher. The vulnerability is a Sensitive I...

CVE-2024-9889

CVE-2024-9889 affects ElementInvader Addons for Elementor (WordPress). The vulnerability allows authenticated attackers with contributor-level access and above to perform Sensitive Information Exposure via the Page Loader widget, enabling viewing of private/draft/password-protected posts, pages, ...

CVE-2024-9425 Advanced Category and Custom Taxonomy Image <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode

The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adtaximage shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10057 RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode

The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10080 WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10055

CVE-2024-10055 affects the WordPress plugin Click to Chat – WP Support All-in-One Floating Widget. It enables Stored Cross-Site Scripting via the wpsaio_snapchat shortcode in all versions up to and including 2.3.3. The vulnerability requires at least contributor-level authentication and allows an...

CVE-2024-10014

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...