PT-2024-17587 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.18 Description: The issue is related to Stored Cross-Site Scripting via the button onclick attribute due to insufficient input sanitization and output...

PT-2024-15857 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.1 Description: The issue is related to Stored Cross-Site Scripting via the side image URL parameter in the Age Gate due to insufficient input sanitization...

WordPress Essential Addons for Elementor Plugin <= 5.9.8 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.8 Fixed in 5.9.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1276 Patch priority Low CVSS severity Low 6.5 Developer WPDeveloper PSID b864b4f9f50d Credits RandomRoot...

CVE-2024-24831

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Leap13 Premium Addons for Elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.10.16...

CVE-2024-0977

The Timeline Widget For Elementor Elementor Timeline, Vertical & Horizontal Timeline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image URLs in the plugin's timeline widget in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output...

CVE-2024-0977

The CVE-2024-0977 entry concerns Timeline Widget For Elementor (WordPress) up to version 1.5.3, which is vulnerable to stored XSS via image URLs due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (Contributor+). The issue is mitigated by upgradi...

CVE-2024-1055

The PowerPack Addons for Elementor Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's buttons in all versions up to, and including, 2.7.14 due to insufficient input sanitization and output escaping on user supplied URL values...

WordPress PowerPack Addons for Elementor Plugin <= 2.7.14 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Addons for Elementor Type Plugin Vulnerable versions = 2.7.14 Fixed in 2.7.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1055 Patch priority Low CVSS severity Low 6.5 Developer IdeaBox Creations PSID 07e0415bb2da Credits...

WordPress Plugin Timeline Widget For Elementor Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2024-0585

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 5.9.4 due to insufficient input sanitization and...

CVE-2024-0586

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Login/Register Element in all versions up to, and including, 5.9.4 due to insufficient input sanitization and output escapi...

WordPress plugin Essential Addons for Elementor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability in the WordPress...

WordPress plugin Exclusive Addons for Elementor Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress plugin Mighty Addons for Elementor Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Mighty Addons for Elementor Plugin <= 1.9.3 is vulnerable to Cross Site Scripting (XSS)

Software Mighty Addons for Elementor Type Plugin Vulnerable versions = 1.9.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24846 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 487dfa184881 Credits Yudistira Arya Require...

WordPress Essential Addons for Elementor Plugin <= 5.9.7 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.7 Fixed in 5.9.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0954 Patch priority Low CVSS severity Low 6.5 Developer WPDeveloper PSID a111b892d269 Credits Webbernaut...

WordPress PowerPack Pro for Elementor Plugin <= 2.10.6 is vulnerable to Settings Change

Software PowerPack Pro for Elementor Type Plugin Vulnerable versions = 2.10.6 Fixed in 2.10.8 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-24844 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID ad539f87b78f Credits Dave Jong Patchstac...

CVE-2024-0824

The CVE-2024-0824 entry concerns the WordPress plugin Exclusive Addons for Elementor. A Stored Cross-Site Scripting (XSS) flaw exists in the Link Anything feature across all versions up to 2.6.8, caused by insufficient input sanitization and output escaping. The vulnerability can be exploited by ...

CVE-2024-0824 Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Anything functionality in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2022-23180 Contact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings Update

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings...