CVE-2024-12477

The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2024-12477

creationtimestamp| type| source ---|---|--- 2025-01-22 22:02:39+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/2671 2025-01-22 22:15:39+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgefeprjpp2h 2025-01-22 22:40:13+00:00| seen|...

CVE-2024-12477

CVE-2024-12477 — The Avada Builder WordPress plugin is vulnerable to a Stored Cross-Site Scripting (XSS) via the plugin’s shortcodes. All versions up to and including 3.11.11 are affected due to insufficient input sanitization and output escaping on user-supplied attributes. An attacker with at l...

CVE-2024-12477 Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets

The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2024-12477 Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets

The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...