PT-2024-17352 · WordPress · Email Address Obfuscation

Name of the Vulnerable Software and Affected Versions: Email Address Obfuscation plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via the class parameter due to insufficient input sanitization and output escaping. This allo...

WordPress FancyBox for WordPress plugin <= 3.3.4 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin FancyBox for WordPress versions = 3.3.4...

WordPress Accordion Slider plugin <= 1.9.12 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Accordion Slider versions = 1.9.12...

WordPress Easy Social Feed Premium plugin <= 6.6.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Easy Social Feed Premium versions = 6.6.2...

WordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.3.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Visual Portfolio, Photo Gallery & Post Grid versions = 3.3.9...

WordPress Carousel, Slider, Gallery by WP Carousel plugin <= 2.6.8 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Carousel, Slider, Gallery by WP Carousel versions = 2.6.8...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.4.4 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.4.4...

WordPress WP eCards plugin <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin WP eCards versions = 1.3.904...

WordPress Contact Form, Survey & Form Builder – MightyForms plugin <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Contact Form, Survey & Form Builder – MightyForms versions = 1.3.9...

CVE-2024-11782

The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstsubscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-12062

CVE-2024-12062 affects Charity Addon for Elementor ( WordPress ) up to version 1.3.2. Root cause: information exposure via the nacharity_elementor_template shortcode due to insufficient restriction on which posts can be included. Impact: authenticated attackers with Contributor-level access or hi...

CVE-2024-12062 Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure

The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.3 via the 'nacharityelementortemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers...

CVE-2024-11782

CVE-2024-11782 concerns the WP Mailster WordPress plugin. Public sources confirm a Stored Cross-Site Scripting (XSS) flaw in the plugin’s mst_subscribe shortcode, exploitable by authenticated users with contributor-level access and above. Affected versions: all up to and including 1.8.17.0. The i...

CVE-2024-12062 Charity Addon for Elementor <= 1.3.2 - Authenticated (Contributor+) Post Disclosure

The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.2 via the 'nacharityelementortemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers...

CVE-2024-11782 WP Mailster <= 1.8.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstsubscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-11866

CVE-2024-11866 affects the WordPress plugin BMLT Tabbed Map (versions up to and including 1.1.8). The vulnerability is a Stored Cross‑Site Scripting (XSS) via the plugin shortcode bmlt_tabbed_map , caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploita...

CVE-2024-11866 BMLT Tabbed Map <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

The BMLT Tabbed Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlttabbedmap' shortcode in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11853

The jAlbum Bridge plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ar’ parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-11898

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swin-campaign' shortcode in all versions up to, and including, 2.6.9 due to insufficient input...

CVE-2024-11898

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swin-campaign' shortcode in all versions up to, and including, 2.6.9 due to insufficient input...