CVE-2024-9895

The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mooreceiptlink shortcode in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-9895 Smart Online Order for Clover <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode

The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mooreceiptlink shortcode in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-9895 Smart Online Order for Clover <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode

The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mooreceiptlink shortcode in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-6757

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the getimagealt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-6757 Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the getimagealt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-6757

CVE-2024-6757 : Elementor Website Builder for WordPress ( 3.23.5, with Patchstack noting fixed in 3.24.6; Wordfence/Red Hat references align on patching. Short-term mitigations include restricting access to the affected function. The vulnerability is categorized as Medium risk per available data,...

WordPress WP VR Plugin <= 8.5.4 is vulnerable to Broken Access Control

Software WP VR Type Plugin Vulnerable versions = 8.5.4 Fixed in 8.5.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49293 Patch priority Low CVSS severity Low 4.3 Developer WPFunnels Team PSID ece40c2ceb73 Credits Trương Hữu Phúc truonghuuphuc Required...

WordPress Cooked Pro Plugin < 1.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Cooked Pro Type Plugin Vulnerable versions 1.8.0 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49289 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bde6da8a46e5 Credits RE-ALTER Required privilege Contributor...

WordPress Point Maker Plugin <= 0.1.4 is vulnerable to Local File Inclusion

Software Point Maker Type Plugin Vulnerable versions = 0.1.4 Fixed in 0.1.5 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-49317 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID c1446754dc54 Credits theviper17 Required privilege Contributor...

PT-2024-39699

Name of the Vulnerable Software and Affected Versions Accordion Slider plugin for WordPress versions up to, and including, 1.9.11 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the html attribute of an accordion slider...

WordPress ElementInvader Addons for Elementor Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

Software ElementInvader Addons for Elementor Type Plugin Vulnerable versions = 1.2.8 Fixed in 1.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9888 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2293b37c11ea Credits Coli...

WordPress Elementor plugin <= 3.24.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt function vulnerability

Authenticated Contributor+ Basic Information Exposure via getimagealt function vulnerability discovered by stealthcopter in WordPress Plugin Elementor Website Builder versions = 3.24.5...

WordPress Elementor Addon Elements plugin <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections vulnerability

Authenticated Contributor+ Sensitive Information Exposure via tablesavedsections vulnerability discovered by Ankit Patel in WordPress Plugin Elementor Addon Elements versions = 1.13.8...

WordPress Social Sharing (by Danny) plugin <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Social Sharing by Danny versions = 1.3.7...

WordPress wpPricing Builder Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)

Software wpPricing Builder Type Plugin Vulnerable versions = 1.5.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49225 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f294416b505a Credits SOPROBRO Required privilege Contributo...

WordPress Elementor Addon Elements Plugin <= 1.13.8 is vulnerable to Sensitive Data Exposure

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.13.8 Fixed in 1.13.9 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8902 Patch priority Low CVSS severity Low 4.3 Developer WPVibes PSID ba1eb37881f7 Credits Ankit Patel Required...

PT-2024-37853 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder plugin for WordPress versions up to, and including, 3.23.5 Description: The issue allows authenticated attackers with Contributor-level access and above to extract either excerpt data or titles of private or...

WordPress Plexx Elementor Extension Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Plexx Elementor Extension Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49234 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d2192b71a7de Credits Khalid Yusuf Required...

WordPress Dynamic Elementor Addons Plugin <= 1.0.0 is vulnerable to Local File Inclusion

Software Dynamic Elementor Addons Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-49243 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID d810ec8583c8 Credits João Pedro S Alcântara Kinorth...

CVE-2024-8902 Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections

The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the rendercolumn function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level...