CVE-2024-3714

CVE-2024-3714 affects the GiveWP – Donation Plugin and Fundraising Platform for WordPress. It is a Stored XSS via the plugin’s give_form shortcode when used with a legacy form in all versions up to and including 3.10.0, caused by insufficient input sanitization and output escaping on user-supplie...

CVE-2024-4374

CVE-2024-4374 affects the DethemeKit For Elementor WordPress plugin. A Stored XSS exists in widget attributes due to insufficient input sanitization and output escaping, enabling an authenticated attacker with contributor-level access or higher to inject scripts that run when users load injected ...

CVE-2024-4865

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2024-4865 Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

PT-2024-27329 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to, and including, 3.10.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'give form' shortcode when used with a legacy form. This is due to...

Testimonial Carousel For Elementor < 10.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'showlinetext ' and 'slidebuttonhoveranimation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization and output escaping. This makes i...

Yoast SEO < 22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘displayname’ author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4580

The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes i...

CVE-2024-4580 Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes i...

CVE-2024-4634

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hfesvgmimetypes’ function in versions up to, and including, 1.6.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4838

The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settingsencoded' attribute of the 'smilemodal' shortcode. This makes it possible for authenticated attackers, with...

CVE-2024-4400

CVE-2024-4400 affects the WordPress plugin “Post and Page Builder by BoldGrid – Visual Drag and Drop Editor.” The vulnerability is a Stored Cross‑Site Scripting (XSS) flaw caused by insufficient input sanitization and output escaping in versions up to and including 1.26.4. Authentication is requi...

CVE-2024-4838

CVE-2024-4838 - ConvertPlus (WordPress) : A PHP Object Injection exists in all versions up to 3.5.26 via deserialization of untrusted input from the settings_encoded attribute of the smile_modal shortcode. Exploitation requires at least contributor-level authentication; there is no POP chain by d...

CVE-2024-4391

The vulnerability CVE-2024-4391 affects the Happy Addons for Elementor WordPress plugin (Event Calendar widget). According to connected Patchstack/Wordfence details, versions up to 3.10.7 are affected due to insufficient input sanitization and output escaping on user-supplied attributes, enabling...

CVE-2024-4391 Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Event Calendar widget in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4546

The Custom Post Type Attachment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pdfattachment' shortcode in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-4546

CVE-2024-4546 affects the WordPress plugin Custom Post Type Attachment . It is vulnerable to Stored Cross-Site Scripting via the plugin’s pdf_attachment shortcode in all versions up to and including 3.4.5 due to insufficient input sanitization and output escaping on user-supplied attributes. The ...

CVE-2024-4478 Happy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group widget in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied 'tooltipposition' attribute. This makes it...

CVE-2024-4984

The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘displayname’ author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

CVE-2024-4984

Yoast SEO for WordPress is affected by CVE-2024-4984: Stored XSS via the display_name author meta in versions up to 22.6. An authenticated attacker with contributor-level access or higher could inject scripts executed by users on affected pages. The vulnerability arises from insufficient input sa...