CVE-2024-11883

CVE-2024-11883 affects the Connatix Video Embed WordPress plugin. The vulnerability is a Stored XSS via the plugin shortcode cnx_script_code in versions up to and including 1.0.5, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at l...

CVE-2024-11770

CVE-2024-11770 refers to a Stored Cross-Site Scripting vulnerability in the Post Carousel & Slider WordPress plugin. Affected: Post Carousel & Slider (WordPress plugin) up to version 1.0.4. Root cause: insufficient input sanitization and output escaping on user-supplied attributes in the post-cs ...

CVE-2024-11876

CVE-2024-11876 affects the Kredeum NFTs WordPress plugin (up to version 1.6.9) via a Stored XSS in the kredeum_opensky shortcode due to insufficient input sanitization/output escaping. Exploitation requires contributor+ access; attack injects script in pages viewed by users. Connected records con...

CVE-2024-11876 Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kredeumopensky' shortcode in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping ...

CVE-2024-11759 Bukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bukza' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2024-11751

CVE-2024-11751 affects the TCBD Popover plugin for WordPress. It is a Stored XSS via the tcbd-popover-image shortcode in all versions up to 1.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires contributor-level access or higher; the pay...

CVE-2024-11867 Companion Portfolio – Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Companion Portfolio – Responsive Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'companion-portfolio' shortcode in all versions up to, and including, 2.4.0.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11867 Companion Portfolio – Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Companion Portfolio – Responsive Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'companion-portfolio' shortcode in all versions up to, and including, 2.4.0.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11867

CVE-2024-11867 affects the Companion Portfolio – Responsive Portfolio Plugin for WordPress. The issue is Stored Cross-Site Scripting via the plugin’s companion-portfolio shortcode in all versions up to and including 2.4.0.1, caused by insufficient input sanitization and output escaping on user-su...

PT-2024-16466 · WordPress +1 · Shortcodes For Elementor +1

Name of the Vulnerable Software and Affected Versions: Shortcodes for Elementor plugin for WordPress versions up to, and including, 1.0.4 RSTheme affected versions not specified Description: The issue is related to Information Exposure, where insufficient restrictions on which posts can be includ...

PT-2024-17310 · WordPress · Glomex Oembed Plugin

Name of the Vulnerable Software and Affected Versions: glomex oEmbed plugin for WordPress versions prior to 0.9.1 Description: The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's glomex integration shortcode due to insufficient input sanitization a...

PT-2024-17306 · WordPress · Buk

Name of the Vulnerable Software and Affected Versions: Buk for WordPress plugin versions up to, and including, 1.0.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'buk' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-17302 · WordPress · Tabs Maker

Name of the Vulnerable Software and Affected Versions: Tabs Maker plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on tab descriptions. This allows authenticated...

PT-2024-17247 · WordPress · Post Carousel & Slider

Name of the Vulnerable Software and Affected Versions: The Post Carousel & Slider plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode due to insufficient input sanitization and output...

PT-2024-17636 · WordPress · Woocommerce Cart Count Shortcode

Name of the Vulnerable Software and Affected Versions: WooCommerce Cart Count Shortcode plugin for WordPress versions up to, and including, 1.0.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the cart button shortcode. This...

PT-2024-17232 · WordPress · Eveeno

Name of the Vulnerable Software and Affected Versions: Eveeno plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-17321 · WordPress · Wp Photo Text Slider 50

Name of the Vulnerable Software and Affected Versions: Wp photo text slider 50 plugin for WordPress versions up to, and including, 8.1 Description: The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-photo-slider' shortcode due to...

WordPress TCBD Popover plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin TCBD Popover versions = 1.2...

WordPress Posts and Products Views for WooCommerce plugin <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Posts and Products Views for WooCommerce versions = 2.1...

WordPress Get Post Content Shortcode plugin <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Disclosure via postcontent Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Get Post Content Shortcode versions = 0.4...