CVE-2024-10343 Beek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Beek Widget Extention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10150

CVE-2024-10150 concerns the Bamazoo – Button Generator WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in the dgs shortcode, caused by insufficient input sanitization and output escaping on user-supplied attributes, affecting all versions up to and including 1.0. Exploi...

CVE-2024-10150 Bamazoo – Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode

The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-10341

CVE-2024-10341 relates to the WordPress plugin League of Legends Shortcodes. The vulnerability is an SQL Injection in the plugin’s shortcode for versions up to and including 1.0.1, caused by insufficient escaping of the user-supplied parameter and inadequate preparation of the SQL query. Exploita...

CVE-2024-9235

The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capability check on the mapsterwpmapssetoptionfromjs function in all versions up to, and including, 1.5.0. This makes it possible for...

CVE-2024-9235

CVE-2024-9235 relates to Mapster WP Maps (WordPress) plugin, affected versions up to and including 1.5.0. The issue is caused by an insufficient capability check in the mapster_wp_maps_set_option_from_js() function, enabling authenticated attackers with contributor-level access and above to updat...

CVE-2024-10148

CVE-2024-10148 affects the WordPress plugin “Awesome Buttons” (versions

PT-2024-39510 · WordPress · Mapster Wp Maps

Name of the Vulnerable Software and Affected Versions: Mapster WP Maps plugin for WordPress versions up to, and including, 1.5.0 Description: The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to an insufficient capability check on the mapster wp...

PT-2024-16065 · WordPress · Bamazoo – Button Generator

Name of the Vulnerable Software and Affected Versions: Bamazoo – Button Generator plugin for WordPress versions up to, and including, 1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's dgs shortcode. This allows...

PT-2024-16227

Name of the Vulnerable Software and Affected Versions WP-Members Membership Plugin versions up to, and including, 3.4.9.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's wpmem loginout shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16201 · WordPress · League Of Legends Shortcodes

Name of the Vulnerable Software and Affected Versions: League of Legends Shortcodes plugin for WordPress versions up to, and including, 1.0.1 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query,...

CVE-2024-8666: Improper Neutralization of Input During Web Page Generation

The Shoutcast Icecast HTML5 Radio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'html5radio' shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-10341: Improper Neutralization of Special Elements used in an SQL Command

The League of Legends Shortcodes plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2024-10150: Improper Neutralization of Input During Web Page Generation

The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-9585: Improper Neutralization of Input During Web Page Generation

The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saveproject' function with an arbitrary shortcode in versions up to, and including, 6.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-9584: Missing Authorization

The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functions in versions up to, and including, 6.0.20. This makes it possible for authenticated attackers with contributor-level privileges or abov...

PT-2024-39164

Name of the Vulnerable Software and Affected Versions: Shoutcast Icecast HTML5 Radio Player plugin for WordPress versions up to, and including, 2.1.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'html5radio' shortcode due to insufficient input sanitization and...

CVE-2024-10148: Improper Neutralization of Input During Web Page Generation

The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-10112: Improper Neutralization of Input During Web Page Generation

The Simple News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'news' shortcode in all versions up to, and including, 2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2024-10342: Improper Neutralization of Input During Web Page Generation

The League of Legends Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...