CVE-2024-10352

The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the getcontenttype function in includes/widgets/content-reveal.php. This makes it possible for authenticated attackers, with Contributor-level acce...

WordPress plugin MG Post Contributors 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-34848 · Mahesh Waghmare · Mg Post Contributors

Name of the Vulnerable Software and Affected Versions: MG Post Contributors versions prior to 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This is a Reflected XSS vulnerability, which exists in Mahesh...

CVE-2024-10187

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycredlink shortcode in all version...

PT-2024-16463 · WordPress · Attesa Extra

Name of the Vulnerable Software and Affected Versions: Attesa Extra plugin for WordPress versions up to, and including, 1.4.2 Description: The issue concerns insufficient restrictions on which posts can be included via the attesa-template shortcode, leading to Information Exposure. This allows...

PT-2024-16571 · WordPress · Code Embed

Name of the Vulnerable Software and Affected Versions: Code Embed plugin for WordPress versions up to 2.5 Description: The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery via the ce get file function. This makes it possible for authenticated attackers, with...

PT-2024-16485 · WordPress · Mappress Maps

Name of the Vulnerable Software and Affected Versions: MapPress Maps for WordPress versions up to, and including, 2.94.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Map block due to insufficient input sanitization and output escaping on user-supplied...

WordPress MG Post Contributors plugin <= 1.3. - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin MG Post Contributors versions = 1.3...

WordPress MG Post Contributors Plugin <= 1.3. is vulnerable to Cross Site Scripting (XSS)

Software MG Post Contributors Type Plugin Vulnerable versions = 1.3. Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51701 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 80baf1e54702 Credits João Pedro S Alcântara Kinorth...

WordPress Gutenberg Blocks by Kadence Blocks <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.3.1...

CVE-2024-10226

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Premium Addons for Elementor plugin <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via Video Box Widget vulnerability discovered by zer0gh0st in WordPress Plugin Premium Addons for Elementor versions = 4.10.60...

CVE-2024-10342

The League of Legends Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-10150

The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

WordPress Image Map Pro plugin <= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete vulnerability

Missing Authorization to Authenticated Contributor+ Map Project Add/Update/Delete vulnerability discovered by István Márton in WordPress Plugin Image Map Pro versions = 6.0.20...

WordPress Beek Widget Extention plugin <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by István Márton in WordPress Plugin Beek Widget Extention versions = 0.9.5...

CVE-2024-9650

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all versions up to, and including, 9.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2024-8667

CVE-2024-8667: HurryTimer plugin for WordPress and WooCommerce vulnerable to unauthorized post publication due to missing capability check in activateCampaign() in versions up to 2.10.0. Authenticated attackers with contributor-level access or higher can publish arbitrary posts. Remediation: upgr...

WordPress HurryTimer plugin <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Publication vulnerability discovered by Webbernaut in WordPress Plugin HurryTimer versions = 2.10.0...

CVE-2024-10080

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...