CVE-2023-4604 Slideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting via 'post'

The Slideshow, Image Slider by 2J plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘post’ parameter in versions up to, and including, 1.3.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2023-4604

CVE-2023-4604 affects the WordPress plugin Slideshow, Image Slider by 2J. It enables Reflected XSS via the post parameter in versions up to and including 1.3.54 due to insufficient input sanitization and output escaping. The vulnerability allows unauthenticated attackers to inject arbitrary scrip...

CVE-2023-4507

CVE-2023-4507 affects Admission AppManager (WordPress plugin). It enables Reflected XSS via the q parameter in versions up to 1.0.0. An unauthenticated user can lure a victim to click a crafted link, causing injected scripts to run in pages, per Wordfence details. Patch status listed as Unpatched...

CVE-2023-4507 Admission AppManager <= 1.0.0 - Reflected Cross-Site Scripting

The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

SUSE CVE-2024-22116

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure...

WordPress plugin tagDiv Opt-In Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2024-7144

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slideid' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2024-7144

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slideid' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2024-7144 JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slideid' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2024-7136

The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-7136 JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-7136 JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-7136

CVE-2024-7136 affects the JetSearch WordPress plugin (all versions

CVE-2024-7147

JetBlocks for Elementor (WordPress) is affected by CVE-2024-7147: Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to 1.3.12 due to insufficient input sanitization and output escaping. Attack requires authenticated access at Contributor level or higher, and can e...

CVE-2024-7147 JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and including, 1.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-7147 JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and including, 1.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-7301

The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-7301 WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-7301

CVE-2024-7301 : WordPress File Upload plugin for WordPress suffers Stored Cross-Site Scripting via SVG uploads in all versions up to 4.24.8 due to insufficient input sanitization and output escaping. Unauthenticated attackers could inject scripts that execute when users view the SVG. Risk details...

CVE-2022-3399

The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cookienoticeoptionsrefusecodehead' parameter in versions up to, and including, 2.4.17.1 due to insufficient input sanitization and output escaping. This makes it possible for...