CVE-2024-5611

CVE-2024-5611 : The Stratum – Elementor Widgets plugin for WordPress (versions

CVE-2024-2695

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.13 due to insufficient input sanitization and output escaping on user supplied attributes such as 'borderradius', 'services' and...

CVE-2024-4095

CVE-2024-4095 – Collapse-O-Matic (WordPress) vulnerability : An authenticated attacker with contributor-level access and above can trigger a Stored Cross-Site Scripting (XSS) via the plugin’s shortcodes expand/expandsub in all versions up to at least 1.8.5.7 (and referenced entries note 1.8.5.8 a...

CVE-2024-2695 Shariff Wrapper <= 4.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.13 due to insufficient input sanitization and output escaping on user supplied attributes such as 'borderradius', 'services' and...

CVE-2024-2695

CVE-2024-2695 affects Shariff Wrapper for WordPress (versions up to and including 4.6.13). The flaw is Stored XSS via the shariff shortcode due to insufficient input sanitization and output escaping of attributes (e.g., borderradius, timestamp). Exploitation requires authenticated access at contr...

CVE-2024-1399 Restaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-1399 Restaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-6000 FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload

The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'displayticketthemespage' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with...

CVE-2024-4479

CVE-2024-4479: Jeg Elementor Kit for WordPress is affected by stored XSS via JKit - Tabs and JKit - Accordion widgets in versions up to 2.6.5. Exploitation requires at least Contributor-level authentication; the issue arises from insufficient input sanitization and output escaping. A fix is avail...

CVE-2024-5263 ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5263: Improper Neutralization of Input During Web Page Generation

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-36716

Name of the Vulnerable Software and Affected Versions The Stratum – Elementor Widgets plugin for WordPress versions up to, and including, 1.4.1 Description The issue is related to Stored Cross-Site Scripting via the label years attribute within the Countdown widget due to insufficient input...

PT-2024-18010

Name of the Vulnerable Software and Affected Versions The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress versions up to, and including, 2.4.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input...

PT-2024-29167

Name of the Vulnerable Software and Affected Versions Collapse-O-Matic plugin for WordPress versions up to, and including, 1.8.5.7 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'expand' and 'expandsub' shortcode. This allo...

CVE-2024-4095: Improper Neutralization of Input During Web Page Generation

The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' and 'expandsub' shortcode in all versions up to, and including, 1.8.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-4479: Improper Neutralization of Input During Web Page Generation

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sggeneraltoggletabenable and sgaccordionstyle attributes within the plugin's JKit - Tabs and JKit - Accordion widget, respectively, in all versions up to, and including, 2.6.5 due to insufficient input...

CVE-2024-1399: Improper Neutralization of Input During Web Page Generation

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

PT-2024-21594

Name of the Vulnerable Software and Affected Versions Shariff Wrapper plugin for WordPress versions up to, and including, 4.6.13 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, such as borderradius and timestamp, in the plugin's...

CVE-2024-2695: Improper Neutralization of Input During Web Page Generation

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.13 due to insufficient input sanitization and output escaping on user supplied attributes such as 'borderradius', 'services' and...

CVE-2024-4863 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parameter in all versions up to, and including, 3.2.38 due to insufficient input sanitization and output escaping. This makes it possible for...