CVE-2024-11384

The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVE-2024-11875 Add infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Add infos to the events calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fuss' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11914

The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attire-blocks/post-carousel' block in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11901 PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MOAPIPOWERBI' shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11442

CVSS/Impact (CVE-2024-11442) A stored XSS flaw exists in the WordPress plugin “Horizontal scroll image slideshow” (all versions up to 10.1) due to insufficient input sanitization and output escaping in the plugin’s shortcode. If a user with contributor-level or higher privileges uses the shortcod...

CVE-2024-12461: Improper Neutralization of Input During Web Page Generation

The WP-Revive Adserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpreviveasync' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11442: Improper Neutralization of Input During Web Page Generation

The Horizontal scroll image slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'horizontal-scroll-image-slideshow' shortcode in all versions up to, and including, 10.1 due to insufficient input sanitization and output escaping on user supplied attributes...

PT-2024-16989

Name of the Vulnerable Software and Affected Versions Surbma | SalesAutopilot Shortcode plugin for WordPress versions prior to 2.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'sa-form' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-17326

Name of the Vulnerable Software and Affected Versions Perfect Font Awesome Integration plugin for WordPress versions up to and including 2.3 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'pfai' shortcode. This...

PT-2024-16382

Name of the Vulnerable Software and Affected Versions Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress versions up to, and including, 1.20.2 Description The issue is related to Stored Cross-Site Scripting via the post title...

PT-2024-17253

Name of the Vulnerable Software and Affected Versions Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress versions prior to 4.7 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode due to insufficient input sanitization and output...

CVE-2024-11427: Improper Neutralization of Input During Web Page Generation

The Catch Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catch-popup' shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-17242

Name of the Vulnerable Software and Affected Versions WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress versions up to, and including, 1.3.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'gs book showcas...

CVE-2024-11750: Improper Neutralization of Input During Web Page Generation

The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11766: Improper Neutralization of Input During Web Page Generation

The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gsbookshowcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output...

CVE-2024-11430: Improper Neutralization of Special Elements used in an SQL Command

The SQL Chart Builder plugin for WordPress is vulnerable to SQL Injection via the 'arg1' arg of the 'gvnschart2' shortcode in all versions up to, and including, 2.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak...

PT-2024-17241

Name of the Vulnerable Software and Affected Versions WordPress Portfolio Plugin versions up to, and including, 1.6.3 Description The WordPress Portfolio Plugin is vulnerable to Stored Cross-Site Scripting via the plugin's gs portfolio shortcode due to insufficient input sanitization and output...

CVE-2024-11781: Improper Neutralization of Input During Web Page Generation

The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

PT-2024-17230

Name of the Vulnerable Software and Affected Versions ONLYOFFICE DocSpace plugin for WordPress versions up to, and including, 2.1.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode due to insufficient input sanitization and output...

PT-2024-16097

Name of the Vulnerable Software and Affected Versions Cognito Forms plugin for WordPress versions up to, and including, 2.0.6 Description The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. This allows authenticated...