PT-2024-17214 · WordPress · Bookingpress

Name of the Vulnerable Software and Affected Versions: BookingPress plugin for WordPress versions up to, and including, 1.1.21 Description: The issue is related to SQL Injection via the category parameter of the 'bookingpress form' shortcode. This is due to insufficient escaping on the...

PT-2024-17637 · Teplitsa · Shmapper

Name of the Vulnerable Software and Affected Versions: ShMapper by Teplitsa plugin for WordPress versions up to, and including, 1.4.18 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'shmMap' shortcode due to insufficient input sanitization and output escaping on...

WordPress shMapper by Teplitsa plugin <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin ShMapper by Teplitsa versions = 1.4.18...

WordPress Elementor plugin <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Typography Settings vulnerability discovered by zer0gh0st in WordPress Plugin Elementor Website Builder versions = 3.25.9...

CVE-2024-12588 Shortcodes and extra features for Phlox theme <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widget

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-17716 · WordPress · Real.Kit Plugin

Name of the Vulnerable Software and Affected Versions: real.Kit plugin for WordPress versions up to and including 5.1.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2024-17327 · WordPress · Spoki

Name of the Vulnerable Software and Affected Versions: Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress versions up to, and including, 2.15.14 Description: The issue is related to Stored Cross-Site Scripting via the plugin's spoki button shortcode due to insufficient input...

PT-2024-17250 · WordPress · Pcrecruiter Extensions

Name of the Vulnerable Software and Affected Versions: PCRecruiter Extensions plugin for WordPress versions up to, and including, 1.4.10 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode due to insufficient input sanitization and output...

PT-2024-17655 · WordPress · Button Block

Name of the Vulnerable Software and Affected Versions: Button Block plugin for WordPress versions up to, and including, 1.1.5 Description: The issue allows authenticated attackers with Contributor-level access and above to extract potentially sensitive data from draft, scheduled, private, and...

CVE-2024-10356

The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.8 in inc/Widgets/accordion/output/content.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

PT-2024-17602 · WordPress · Ganohrs Toggle Shortcode

Name of the Vulnerable Software and Affected Versions: Ganohrs Toggle Shortcode plugin for WordPress versions up to, and including, 0.2.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode due to insufficient input sanitization and output escaping...

PT-2024-17597 · WordPress · Posts/Products Views For Woocommerce

Name of the Vulnerable Software and Affected Versions: Posts and Products Views for WooCommerce plugin for WordPress versions up to, and including, 2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'papvfwc views' shortcode due to insufficient input sanitizatio...

PT-2024-17328 · WordPress · Permalinker

Name of the Vulnerable Software and Affected Versions: The Permalinker plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-17315 · WordPress · Stripe Donation Plugin

Name of the Vulnerable Software and Affected Versions: Stripe Donation plugin for WordPress versions 1.2.5 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'stripe donation' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-11910

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-17606 · WordPress · Property Hive Stamp Duty Calculator

Name of the Vulnerable Software and Affected Versions: Property Hive Stamp Duty Calculator plugin for WordPress versions up to, and including, 1.0.22 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'stamp duty calculator scotland' shortcode due to insufficient...

PT-2024-17279 · WordPress · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder – WordPress Page Builder plugin for WordPress versions up to, and including, 2.8.4.4 Description: The issue is related to Stored Cross-Site Scripting via the custom JavaScript row settings due to insufficient input sanitization...

WordPress Hash Form plugin <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation vulnerability

Missing Authorization to Authenticated Contributor+ Form Style Creation vulnerability discovered by Noah Stead TurtleBurg in WordPress Plugin Hash Form versions = 1.2.1...

CVE-2024-10784

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-12059

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the elioptionvalue shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...