CVE-2024-9885

The CVE-2024-9885 entry covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin Widget or Sidebar Shortcode, exploitable via the plugin’s sidebar shortcode in all versions up to 0.6.1. Authenticated attackers with contributor-level access or higher can inject scripts that execu...

CVE-2024-9885 Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, and including, 0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-9885 Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, and including, 0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-8627 Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-8627 Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-9886 WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Baidu Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'baidumap' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9886

CVE-2024-9886 affects the WordPress plugin WP Baidu Map, where the stored XSS vulnerability can be triggered via the plugin’s baidu_map shortcode in versions up to 1.2.2. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes, enabling authenticated u...

CVE-2024-9886 WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Baidu Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'baidumap' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9884 T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The T- Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-39912 · WordPress · Wp Baidu Map

Name of the Vulnerable Software and Affected Versions: WP Baidu Map plugin for WordPress versions up to, and including, 1.2.2 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the baidu map shortcode. This allows authenticated...

PT-2024-39911 · WordPress · Widget/Sidebar Shortcode

Name of the Vulnerable Software and Affected Versions: Widget or Sidebar Shortcode plugin for WordPress versions up to and including 0.6.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'sidebar' shortcode, allowi...

PT-2024-39639 · WordPress · Wp Simple Anchors Links

Name of the Vulnerable Software and Affected Versions: WP Simple Anchors Links plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wpanchor shortcode due to insufficient input sanitization and output escaping ...

WordPress Step by Step Plugin <= 0.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Step by Step Type Plugin Vulnerable versions = 0.4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50535 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e27be9b81170 Credits SOPROBRO Required privilege Contributor...

WordPress ID-SK Toolkit Plugin <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software ID-SK Toolkit Type Plugin Vulnerable versions = 1.7.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50517 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8f37480f4086 Credits Gab Required privilege Contributor Publish...

PT-2024-16124 · WordPress · Wp Team – Wordpress Team Member Plugin

Name of the Vulnerable Software and Affected Versions: WP Team – WordPress Team Member Plugin versions up to, and including, 1.1.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's htteamember shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-10226

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10226 Arconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10226

CVE-2024-10226 : Arconix Shortcodes for WordPress is vulnerable to Stored XSS via the box shortcode in versions ≤ 2.1.13 due to insufficient input sanitization and output escaping on user attributes. Exploitation requires authenticated access at contributor level or higher; injected scripts execu...

CVE-2024-10226 Arconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9505

CVE-2024-9505 affects Beaver Builder – WordPress Page Builder (Plugin). The issue is a stored DOM-based XSS in the Button widget introduced by insufficient input sanitization and output escaping on user-supplied attributes, exploitable by authenticated attackers with contributor-level access and ...