CVE-2024-10667 Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure

The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the csb shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-10814 Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the cegetfile function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originati...

CVE-2024-10669 Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure

The Countdown Timer block – Display the events date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the ctb shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated...

CVE-2024-10669 Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure

The Countdown Timer block – Display the events date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the ctb shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated...

CVE-2024-10814 Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the cegetfile function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originati...

CVE-2024-10770 Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure

The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-10770 Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure

The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-10693 SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure

The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Unfold widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2024-10693

CVE-2024-10693 affects the SKT Addons for Elementor plugin for WordPress (up to version 3.3). The issue is an Information Exposure due to insufficient restrictions in the Unfold widget, allowing authenticated users with Contributor-level access and higher to extract data from private or Elementor...

CVE-2024-10779

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'cetemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-10779

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'cetemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-10779 Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'cetemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-10779 Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'cetemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

WordPress SKT Addons for Elementor plugin <= 3.3 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin SKT Addons for Elementor versions = 3.3...

CVE-2024-10187 myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycredlink shortcode in all version...

CVE-2024-10621 Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pwmap shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10621 Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pwmap shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Christian Science Bible Lesson Subjects Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Christian Science Bible Lesson Subjects Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52353 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 59ad9e29b4b1 Credits SOPROBRO Required...

WordPress Blocks Post Grid Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Blocks Post Grid Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51928 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c0aa1ee5be51 Credits Gab Required privilege Contributor...

WordPress Inline Click To Tweet Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Inline Click To Tweet Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51803 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e9a9fcb00d6e Credits SOPROBRO Required privilege...