CVE-2024-37548

CVE-2024-37548 is an Stored XSS vulnerability in the WordPress plugin Meks Easy Ads Widget, affecting versions through 2.0.8. The vulnerability is described as Improper Neutralization of Input During Web Page Generation (XSS). Public references in the provided documents identify the plugin and af...

PT-2024-27634 · Web357 · Web357 Easy Custom Code

Name of the Vulnerable Software and Affected Versions: Web357 Easy Custom Code LESS/CSS/JS – Live editing versions 1.0.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

Exploit for CVE-2022-30190

Follina-CVE-2022-...

CVE-2024-2337

The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonialsgrid ' shortcode in all versions up to, and including, 3.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2337

The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonialsgrid ' shortcode in all versions up to, and including, 3.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2337 Easy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonialsgrid ' shortcode in all versions up to, and including, 3.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2337

CVE-2024-2337 affects the WordPress plugin Easy Testimonials (versions up to and including 3.9.5). The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the plugin’s testimonials_grid shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes. E...

PT-2024-19846 · WordPress · Easy Testimonials

Name of the Vulnerable Software and Affected Versions: Easy Testimonials plugin for WordPress versions up to, and including, 3.9.5 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the testimonials grid shortcode. This allows...

WordPress Easy Table of Contents plugin < 2.0.67 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Easy Table of Contents versions 2.0.67...

CVE-2024-5479

The Easy Pixels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

CVE-2024-5479

CVE-2024-5479 concerns the Easy Pixels plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting flaw in plugin settings across all versions up to and including 2.13, caused by insufficient input sanitization and output escaping. It enables unauthenticated attackers to inject arbit...

CVE-2024-5479 Easy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site Scripting

The Easy Pixels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

WordPress Easy Pixels by JEVNET plugin <= 2.13 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin Easy Pixels versions = 2.13...

CVE-2024-6334

The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-6334

CVE-2024-6334 affects the Easy Table of Contents WordPress plugin. Vulnerable up to version 2.0.67.0 (before 2.0.67.1) where certain settings aren’t sanitised/escaped, enabling a stored XSS for high-privilege users (e.g., editors) even when unfiltered_html is disallowed. Impact per connected docs...

CVE-2024-6334 Easy Table of Contents < 2.0.67 - Editor+ Stored XSS

The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

WordPress Easy Table of Contents Plugin < 2.0.67 is vulnerable to Cross Site Scripting (XSS)

Software Easy Table of Contents Type Plugin Vulnerable versions 2.0.67 Fixed in 2.0.67.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6334 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cb1a71a30d2b Credits Dmitrii Ignatye...

WordPress Easy Pixels Plugin <= 2.13 is vulnerable to Cross Site Scripting (XSS)

Software Easy Pixels Type Plugin Vulnerable versions = 2.13 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5479 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4b79cc61de42 Credits Lucio Sá Required privile...

Easy!Appointments Security Vulnerability

Easy!Appointments is a web-based appointment and schedule management system. A security vulnerability exists in Easy!Appointments, which stems from an insecure authorization issue in the /services/serviceId interface. A low-privileged attacker can exploit this vulnerability to gain access to,...

Easy!Appointments Security Vulnerability

Easy!Appointments is a web-based appointment and schedule management system. A security vulnerability exists in Easy!Appointments that stems from an insecure authorization issue in the /services interface. A low-privileged attacker can exploit the vulnerability to create services for any user on...