CVE-2024-11855 Koalendar – Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter

The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-12502

CVE-2024-12502 affects the My IDX Home Search WordPress plugin. Vector: Stored XSS via the homeasap-idx-landing shortcode in versions up to 2.0.1 due to insufficient input sanitization and output escaping on user attributes. Impact: authenticated attackers with contributor-level access can inject...

CVE-2024-12411

CVE-2024-12411 affects the WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress. The vulnerability is Stored Cross-Site Scripting via the page parameter in all versions up to and including 2.5.4, caused by insufficient input sanitization and output escapin...

CVE-2024-12411 WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scripting

The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-12411 WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scripting

The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-12517

CVE-2024-12517 affects the WordPress plugin WooCommerce Cart Count Shortcode . It enables a Stored XSS via the plugin's cart_button shortcode attributes. Affected are all versions up to and including 1.0.4. The vulnerability can be exploited by authenticated attackers with at least contributor ri...

CVE-2024-11883

CVE-2024-11883 affects the Connatix Video Embed WordPress plugin. The vulnerability is a Stored XSS via the plugin shortcode cnx_script_code in versions up to and including 1.0.5, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at l...

CVE-2024-11763

CVE-2024-11763 affects the Plezi WordPress plugin. It is a stored XSS via the plugin’s plezi shortcode in all versions up to 1.0.6, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at least Contributor+ privileges and can cause arbit...

CVE-2024-11462 Filestack Official <= 2.1.0 - Reflected Cross-Site Scripting

The Filestack Official plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fstab' and 'filestackoptions' parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2024-11770

CVE-2024-11770 refers to a Stored Cross-Site Scripting vulnerability in the Post Carousel & Slider WordPress plugin. Affected: Post Carousel & Slider (WordPress plugin) up to version 1.0.4. Root cause: insufficient input sanitization and output escaping on user-supplied attributes in the post-cs ...

CVE-2024-11095

The CVE-2024-11095 entry concerns Visualmodo Elements (WordPress plugin). The connected Red Hat advisory reiterates that: Visualmodo Elements is vulnerable to Stored Cross-Site Scripting via REST API SVG file uploads in all versions up to and including 1.0.2, caused by insufficient input sanitiza...

CVE-2024-11759 Bukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bukza' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2024-11889 My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-search' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-17583 · WordPress · Wp Ad Guru

Name of the Vulnerable Software and Affected Versions: WP Ad Guru plugin for WordPress versions up to, and including, 2.5.4 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject...

PT-2024-17602 · WordPress · Ganohrs Toggle Shortcode

Name of the Vulnerable Software and Affected Versions: Ganohrs Toggle Shortcode plugin for WordPress versions up to, and including, 0.2.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode due to insufficient input sanitization and output escaping...

PT-2024-17328 · WordPress · Permalinker

Name of the Vulnerable Software and Affected Versions: The Permalinker plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode due to insufficient input sanitization and output escaping on...

WordPress plugin Visualmodo Elements 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress plugin Tabs Maker 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-17302 · WordPress · Tabs Maker

Name of the Vulnerable Software and Affected Versions: Tabs Maker plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on tab descriptions. This allows authenticated...

PT-2024-17636 · WordPress · Woocommerce Cart Count Shortcode

Name of the Vulnerable Software and Affected Versions: WooCommerce Cart Count Shortcode plugin for WordPress versions up to, and including, 1.0.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the cart button shortcode. This...