CVE-2024-9058 Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lightbox widget in all versions up to, and including, 5.10.5 due to insufficient input sanitization and output...

CVE-2024-9058

CVE-2024-9058 is a stored XSS in the Lightbox widget of the WordPress plugin “Element Pack Elementor Addons” (bdthemes-element-pack-lite/Element Pack Addons for Elementor). The issue exists in all versions up to and including 5.10.5 and is exploitable by authenticated users with Contributor-level...

CVE-2024-10484

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10484 Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10484

CVE-2024-10484: Spectra – WordPress Gutenberg Blocks plugin (≤2.16.2) is vulnerable to Stored XSS via the Team widget due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authentication (contributor level or higher) and can cause arbitrary ...

CVE-2024-10484 Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-9694

CVE-2024-9694 : CMSMasters Elementor Addon for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability across all versions up to 1.14.7. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in multiple widgets, enabling an authen...

CVE-2024-9694 CMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The CMSMasters Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.14.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-17294 · WordPress · Jalbum Bridge

Name of the Vulnerable Software and Affected Versions: jAlbum Bridge plugin for WordPress versions up to, and including, 2.0.15 Description: The issue is related to Stored Cross-Site Scripting via the ar parameter due to insufficient input sanitization and output escaping. This allows authenticat...

WordPress plugin WP Mailster 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

PT-2024-17303 · WordPress · Bmlt Tabbed Map

Name of the Vulnerable Software and Affected Versions: BMLT Tabbed Map plugin for WordPress versions 1.1.8 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'bmlt tabbed map' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16310 · WordPress · Spectra

Name of the Vulnerable Software and Affected Versions: Spectra – WordPress Gutenberg Blocks plugin for WordPress versions up to, and including, 2.16.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'Team' widget due to insufficient input sanitization and output...

PT-2024-17254 · WordPress · Wp Mailster

Name of the Vulnerable Software and Affected Versions: WP Mailster plugin for WordPress versions up to, and including, 1.8.17.0 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the mst...

WordPress jAlbum Bridge plugin <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via ar Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin jAlbum Bridge versions = 2.0.15...

WordPress Spectra plugin <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Team Widget vulnerability discovered by zer0gh0st in WordPress Plugin Spectra versions = 2.16.2...

Exploit for CVE-2024-8672

CVE-2024-8672: Authenticated Contributor Remote Code Execution...

CVE-2024-10980 Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow...

CVE-2024-10980 Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow...

CVE-2024-10780

The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'narestaurantelementortemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for...

CVE-2024-10798

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers,...