CVE-2024-9682

CVE-2024-9682: Royal Elementor Addons and Templates (WordPress) stores cross-site scripting via the Form Builder widget in all versions

CVE-2024-9668 Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2024-9059 Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-9059 Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-9059

CVE-2024-9059 – Royal Elementor Addons and Templates (WordPress) Affected product: Royal Elementor Addons and Templates plugin for WordPress (versions up to and including 1.7.1001). Vulnerability: Stored Cross-Site Scripting (XSS) via the Google Maps widget. Root cause: Insufficient input sanitiz...

CVE-2024-9668

CVE-2024-9668 affects the WordPress plugin Royal Elementor Addons and Templates. The vulnerability is a Stored Cross-Site Scripting (XSS) via the Countdown widget in all versions up to 1.7.1001, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitatio...

CVE-2024-10887

The NiceJob plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes nicejob-lead, nicejob-review, nicejob-engage, nicejob-badge, nicejob-stories in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping ...

CVE-2024-10887

CVE-2024-10887 affects the NiceJob WordPress plugin. It is a Stored XSS via multiple shortcodes (nicejob-lead, -review, -engage, -badge, -stories) in all versions up to 3.6.5 due to insufficient input sanitization and output escaping. Exploitation requires Contributor+ authentication; injected sc...

CVE-2024-10778

CVE-2024-10778 : BuddyPress Builder for Elementor – BuddyBuilder (WordPress plugin) is vulnerable to information exposure in all versions up to 1.7.4 via the shortCode “elementor-template.” The issue arises from insufficient restrictions on which posts can be included, allowing authenticated atta...

CVE-2024-9682: Improper Neutralization of Input During Web Page Generation

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-9059: Improper Neutralization of Input During Web Page Generation

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10887: Improper Neutralization of Input During Web Page Generation

The NiceJob plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes nicejob-lead, nicejob-review, nicejob-engage, nicejob-badge, nicejob-stories in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping ...

CVE-2024-10778: Authorization Bypass Through User-Controlled Key

The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticat...

PT-2024-16621

Name of the Vulnerable Software and Affected Versions NiceJob plugin for WordPress versions prior to 3.6.5 Description The issue is related to Stored Cross-Site Scripting via several of the plugin's shortcodes, including nicejob-lead, nicejob-review, nicejob-engage, nicejob-badge, and...

PT-2024-39395

Name of the Vulnerable Software and Affected Versions The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1001 Description The issue is related to Stored Cross-Site Scripting via the Google Maps widget due to insufficient input sanitization and output...

CVE-2024-9668: Improper Neutralization of Input During Web Page Generation

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2024-10179 Slickstream: Engagement and Conversions <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode

The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10695

The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-10538

CVE-2024-10538 concerns the Happy Addons for Elementor plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) via the before_label parameter in the Image Comparison widget, affecting all versions up to and including 3.12.5. It requires Contributor-level authentication or h...

CVE-2024-10538 Happy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the beforelabel parameter in the Image Comparison widget in all versions up to, and including, 3.12.5 due to insufficient input sanitization and output escaping. This makes it possible for...