PT-2024-15882 · WordPress · Watu Quiz

Name of the Vulnerable Software and Affected Versions: Watu Quiz plugin for WordPress versions up to, and including, 3.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-21585 · WordPress · Link Whisper Free

Name of the Vulnerable Software and Affected Versions: Link Whisper Free plugin for WordPress versions up to, and including, 0.7.1 Description: The issue allows authenticated attackers with contributor-level access and above to inject a PHP Object via deserialization of untrusted input of the...

PT-2024-18442 · WordPress · Getwid

Name of the Vulnerable Software and Affected Versions: Getwid – Gutenberg Blocks plugin for WordPress versions up to, and including, 2.0.5 Description: The issue arises from insufficient input sanitization and output escaping in the block content, allowing authenticated attackers with contributor...

PT-2024-19103 · Wpzoom · Beaver Builder Addons

Name of the Vulnerable Software and Affected Versions: Beaver Builder Addons by WPZOOM plugin for WordPress versions up to, and including, 1.3.4 Description: The issue is related to Stored Cross-Site Scripting via the Testimonials widget due to insufficient input sanitization and output escaping...

PT-2024-20699 · WordPress · The Hubbub Lite

Name of the Vulnerable Software and Affected Versions: The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress versions up to, and including, 1.33.1 Description: The issue allows authenticated attackers with contributor access and above to inject a PHP Object via...

WordPress Powerkit plugin <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

AuthenticatedContributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Powerkit versions = 2.9.1...

CVE-2024-2132

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Widget in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3245

The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Youtube block in all versions up to, and including, 3.9.14 due to insufficie...

WordPress Global Elementor Buttons plugin <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link vulnerability

AuthenticatedContributor+ Stored Cross-Site Scripting via button link vulnerability discovered by Francesco Carlucci in WordPress Plugin Global Elementor Buttons versions = 1.1.0...

Sassy Social Share < 3.3.61 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the...

Happy Addons for Elementor < 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag

Description The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 3.10.4 due to insufficient input sanitization and output escaping on the titletag attribute. This makes it possible for...

CVE-2024-2919

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CountUp Widget in all versions up to, and including, 3.2.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

WordPress Spectra plugin <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS vulnerability

AuthenticatedContributor+ Cross-Site Scripting via Custom CSS vulnerability discovered by Akbar Kustirama in WordPress Plugin Spectra versions = 2.10.3...

WordPress Jeg Elementor Kit plugin <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box andTestimonial vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Image Box andTestimonial vulnerability discovered by Nikolas in WordPress Plugin Jeg Elementor Kit versions = 2.6.3...

CVE-2024-2925

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in all versions up to, and including, 2.8.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-2369

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2024-3148 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.3 Description: The issue is related to Stored Cross-Site Scripting via the Testimonial Widget Attributes due to insufficient input sanitization and output escaping. Thi...

HT Mega < 2.4.4 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user...

CVE-2024-2144

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2024-2142

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...