CVE-2024-10057 RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode

The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10080

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10080

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10055 Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode

The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaiosnapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-10055 Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode

The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaiosnapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-10080 WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10055

CVE-2024-10055 affects the WordPress plugin Click to Chat – WP Support All-in-One Floating Widget. It enables Stored Cross-Site Scripting via the wpsaio_snapchat shortcode in all versions up to and including 2.3.3. The vulnerability requires at least contributor-level authentication and allows an...

CVE-2024-9703

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-9703 Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-9703

CVE-2024-9703 refers to the Arconix Shortcodes WordPress plugin. The vulnerability is a Stored Cross-Site Scripting flaw in the button shortcode, present in all versions up to and including 2.1.12, caused by insufficient input sanitization and output escaping on user-supplied attributes. It can b...

CVE-2024-9703 Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-10014

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-10014

CVE-2024-10014 – Flat UI Button (WordPress) XSS Affected: Flat UI Button plugin for WordPress, version 1.0 and earlier. Root cause: Insufficient input sanitization and output escaping on user-supplied attributes within the flatbtn shortcode. Impact: Stored Cross‑Site Scripting that can execute ar...

CVE-2024-10014 Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-10014 Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode

The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...

WordPress RSS Feed Widget plugin <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via rfw-youtube-videos Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin RSS Feed Widget versions = 2.9.9...

WordPress GERRYWORKS Post by Mail Plugin <= 1.0 is vulnerable to Privilege Escalation

Software GERRYWORKS Post by Mail Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-49608 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 7ce561dc425f Credits Mika Required...

PT-2024-16014 · WordPress · Wp Easy Post Types

Name of the Vulnerable Software and Affected Versions: WP Easy Post Types plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to Stored Cross-Site Scripting via post meta due to insufficient input sanitization and output escaping on user-supplied attributes...

PT-2024-39910 · WordPress · T(-) Countdown

Name of the Vulnerable Software and Affected Versions: T- Countdown plugin for WordPress versions up to, and including, 2.4.8 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the tminus shortcode, allowing authenticated attacker...

PT-2024-16001 · WordPress · Rss Feed Widget

Name of the Vulnerable Software and Affected Versions: RSS Feed Widget plugin for WordPress versions up to, and including, 2.9.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode due to insufficient input sanitization and output escapin...