16790 matches found
CVE-2024-13153
CVE-2024-13153 affects the Unlimited Elements For Elementor plugin for WordPress. It enables Stored XSS via multiple widgets (Image Tooltip, Notification, Simple Popup, Video Play Button, Card Carousel) in all versions up to 1.5.135 due to insufficient input sanitization/escaped output on user at...
PT-2025-2032 · WordPress · Unlimited Elements For Elementor
Name of the Vulnerable Software and Affected Versions: Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.135 Description: The issue is related to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and output escaping on...
PT-2025-1711 · WordPress · Skyword Api Plugin
Name of the Vulnerable Software and Affected Versions: Skyword API Plugin for WordPress versions up to, and including, 2.5.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'skyword iframe' shortcode due to insufficient input sanitization and output escaping on...
CVE-2024-12852
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hacmctext' parameter of the Happy Mouse Cursor in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...
CVE-2024-12851
The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customattributes parameter of the Cookie Consent Widget in all versions up to, and including, 5.10.14 due to...
CVE-2024-12584
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6.2 via the 'duplicate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...
CVE-2024-12852
CVE-2024-12852 refers to a stored XSS vulnerability in the Happy Addons for Elementor plugin for WordPress, exploitable via the ha_cmc_text parameter in the Happy Mouse Cursor. The issue affects all versions up to 3.15.1 and arises from insufficient input sanitization and output escaping. This al...
CVE-2024-12852 Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hacmctext' parameter of the Happy Mouse Cursor in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...
CVE-2024-10151
The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-10151 Auto iFrame < 2.0 - Contributor+ XSS via Shortcode
The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-10151
CVE-2024-10151 concerns the Auto iFrame WordPress plugin (before 2.0). It allows Stored XSS via unvalidated shortcode attributes output in posts when the shortcode is embedded. Affected users must have Contributor+ rights; impact is limited to stored XSS on pages using the shortcode. Connected Re...
CVE-2024-12030
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2024-12030
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2024-12205
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-12205
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-12030 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2024-12030
MDTF – Meta Data and Taxonomies Filter (WordPress) is vulnerable to SQL Injection via the key parameter in the mdf_value shortcode in all versions up to and including 1.3.3.5. The vulnerability requires authentication (Contributor level or higher) and can be leveraged to append additional SQL to ...
CVE-2024-12030 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2024-12205
CVE-2024-12205 affects Themesflat Addons For Elementor for WordPress. This stores cross-site scripting via TF E Slider Widget in versions up to 2.2.4 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (Contributor level or higher) to inject scri...