CVE-2024-10268

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.8 due to insufficient input sanitization and output escaping on user supplie...

CVE-2024-8961

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomoreitemstext’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and...

PT-2024-39352 · WordPress · The Social Proof (Testimonial) Slider

Name of the Vulnerable Software and Affected Versions: The Social Proof Testimonial Slider plugin for WordPress versions up to, and including, 2.2.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's spslider-block...

CVE-2024-10695

The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-51701

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mahesh Waghmare MG Post Contributors mg-post-contributors allows Reflected XSS.This issue affects MG Post Contributors: from n/a through = 1.3...

CVE-2024-51701

CVE-2024-51701 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin MG Post Contributors . Red Hat’s advisory lists the issue and notes it affects MG Post Contributors from n/a through version 1.3 . The CVSS data in the initial description indicates a base score ...

CVE-2024-51701 WordPress MG Post Contributors plugin <= 1.3. - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mahesh Waghmare MG Post Contributors mg-post-contributors allows Reflected XSS.This issue affects MG Post Contributors: from n/a through = 1.3...

CVE-2024-51701 WordPress MG Post Contributors plugin <= 1.3. - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mahesh Waghmare MG Post Contributors mg-post-contributors allows Reflected XSS.This issue affects MG Post Contributors: from n/a through = 1.3...

CVE-2024-10352

The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the getcontenttype function in includes/widgets/content-reveal.php. This makes it possible for authenticated attackers, with Contributor-level acce...

WordPress plugin MG Post Contributors 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-51701: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mahesh Waghmare MG Post Contributors mg-post-contributors allows Reflected XSS.This issue affects MG Post Contributors: from n/a through = 1.3...

PT-2024-34848 · Mahesh Waghmare · Mg Post Contributors

Name of the Vulnerable Software and Affected Versions: MG Post Contributors versions prior to 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This is a Reflected XSS vulnerability, which exists in Mahesh...

CVE-2024-10187

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycredlink shortcode in all version...

PT-2024-16571 · WordPress · Code Embed

Name of the Vulnerable Software and Affected Versions: Code Embed plugin for WordPress versions up to 2.5 Description: The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery via the ce get file function. This makes it possible for authenticated attackers, with...

PT-2024-16463 · WordPress · Attesa Extra

Name of the Vulnerable Software and Affected Versions: Attesa Extra plugin for WordPress versions up to, and including, 1.4.2 Description: The issue concerns insufficient restrictions on which posts can be included via the attesa-template shortcode, leading to Information Exposure. This allows...

PT-2024-16485 · WordPress · Mappress Maps

Name of the Vulnerable Software and Affected Versions: MapPress Maps for WordPress versions up to, and including, 2.94.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Map block due to insufficient input sanitization and output escaping on user-supplied...

WordPress MG Post Contributors plugin <= 1.3. - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin MG Post Contributors versions = 1.3...

WordPress MG Post Contributors Plugin <= 1.3. is vulnerable to Cross Site Scripting (XSS)

Software MG Post Contributors Type Plugin Vulnerable versions = 1.3. Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51701 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 80baf1e54702 Credits João Pedro S Alcântara Kinorth...

WordPress Gutenberg Blocks by Kadence Blocks <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.3.1...

CVE-2024-10226

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...