PT-2024-16097

Name of the Vulnerable Software and Affected Versions Cognito Forms plugin for WordPress versions up to, and including, 2.0.6 Description The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2024-11760: Improper Neutralization of Input During Web Page Generation

The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-11901: Improper Neutralization of Input During Web Page Generation

The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MOAPIPOWERBI' shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10182: Improper Neutralization of Input During Web Page Generation

The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-11413: Improper Neutralization of Input During Web Page Generation

The HostFact bestelformulier integratie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bestelformulier' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-11757: Improper Neutralization of Input During Web Page Generation

The WP GeoNames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-geonames' shortcode in all versions up to, and including, 1.9.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11882: Improper Neutralization of Input During Web Page Generation

The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'faq' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied...

PT-2024-17344

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress versions up to, and including, 1.9.5 Description The issue is related to Stored Cross-Site Scripting via the attire-blocks/post-carousel block due to insufficient input...

CVE-2024-12463: Improper Neutralization of Input During Web Page Generation

The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenaembedamp' shortcode in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-11181: Authorization Bypass Through User-Controlled Key

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wpreusablerender' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticate...

CVE-2024-12201: Missing Authorization

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, ...

PT-2024-16949

Name of the Vulnerable Software and Affected Versions Arena.IM – Live Blogging for real-time events plugin for WordPress versions up to, and including, 0.3.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode due to insufficient input sanitizati...

PT-2024-17420 · WordPress · Elementinvader Addons For Elementor

Name of the Vulnerable Software and Affected Versions: ElementInvader Addons for Elementor plugin for WordPress versions up to and including 1.3.1 Description: The issue allows authenticated attackers with Contributor-level access or higher to extract arbitrary options from the wp options table...

PT-2024-16804

Name of the Vulnerable Software and Affected Versions Greenshift – animation and page builder blocks plugin for WordPress versions up to, and including, 9.9.9.3 Description The issue concerns insufficient restrictions on which posts can be included via the wp reusable render shortcode. This allow...

PT-2024-16968

Name of the Vulnerable Software and Affected Versions YooBar plugin for WordPress versions up to, and including, 2.0.6 Description The YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings due to insufficient input sanitization and output escaping. This...

PT-2024-17257

Name of the Vulnerable Software and Affected Versions Integrate Firebase plugin for WordPress versions up to and including 0.9.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'firebase show' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-11410: Improper Neutralization of Input During Web Page Generation

The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This mak...

CVE-2024-11940: Improper Neutralization of Input During Web Page Generation

The Property Hive Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘price’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-6947: Path Traversal: '/../filedir'

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, whic...

WordPress plugin Best WordPress Gallery Plugin–FooGallery 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...