CVE-2024-10148 Awesome buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode

The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-10148

CVE-2024-10148 affects the WordPress plugin “Awesome Buttons” (versions

PT-2024-16201 · WordPress · League Of Legends Shortcodes

Name of the Vulnerable Software and Affected Versions: League of Legends Shortcodes plugin for WordPress versions up to, and including, 1.0.1 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query,...

PT-2024-16065 · WordPress · Bamazoo – Button Generator

Name of the Vulnerable Software and Affected Versions: Bamazoo – Button Generator plugin for WordPress versions up to, and including, 1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's dgs shortcode. This allows...

PT-2024-16203 · WordPress · Beek Widget Extention

Name of the Vulnerable Software and Affected Versions: Beek Widget Extention plugin for WordPress versions up to, and including, 0.9.5 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-39701 · WordPress · Image Map Pro

Name of the Vulnerable Software and Affected Versions: Image Map Pro plugin for WordPress versions up to, and including, 6.0.20 Description: The issue allows authenticated attackers with contributor-level privileges or above to modify data and potentially cause loss of data due to a missing...

PT-2024-16202 · WordPress · League Of Legends Shortcodes

Name of the Vulnerable Software and Affected Versions: League of Legends Shortcodes plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-39510 · WordPress · Mapster Wp Maps

Name of the Vulnerable Software and Affected Versions: Mapster WP Maps plugin for WordPress versions up to, and including, 1.5.0 Description: The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to an insufficient capability check on the mapster wp...

WordPress Mapster WP Maps plugin <= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update vulnerability

Incorrect Authorization to Authenticated Contributor+ Arbitrary Options Update vulnerability discovered by Sean Murphy in WordPress Plugin Mapster WP Maps versions = 1.5.0...

WordPress Awesome buttons plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Awesome Buttons versions = 1.0...

CVE-2024-10180

CVE-2024-10180 — Stored Cross-Site Scripting in Contact Form 7 – Repeatable Fields (WordPress). Affected: all versions up to 2.0.1; root cause: insufficient input sanitization and output escaping on field_group shortcode attributes. Impact: authenticated attackers with contributor-level access ca...

CVE-2024-10180 Contact Form 7 - Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode

The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fieldgroup shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-9650

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all versions up to, and including, 9.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2024-10176 Compact WP Audio Player <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode

The Compact WP Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's scembedplayer shortcode in all versions up to, and including, 1.9.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10176

CVE-2024-10176 — Compact WP Audio Player (WordPress plugin) A stored XSS flaw affects the Compact WP Audio Player plugin, versions up to and including 1.9.13. The issue stems from insufficient input sanitization and output escaping on the sc_embed_player shortcode attributes, enabling authenticat...

CVE-2024-10176 Compact WP Audio Player <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode

The Compact WP Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's scembedplayer shortcode in all versions up to, and including, 1.9.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-9650 WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all versions up to, and including, 9.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2024-9650

CVE-2024-9650 : WP Recipe Maker for WordPress is vulnerable to stored XSS via the tooltip parameter in all versions up to and including 9.6.1. Exploitation requires Contributor-level access or higher. Connected sources confirm the flaw and that patches exist: fixed in 9.7.0. Affected product/vers...

CVE-2024-10050

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfetemplate shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the contents of Draft...

CVE-2024-10050 Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfetemplate shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the contents of Draft...