CVE-2024-2092 Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2092 Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3925

CVE-2024-3925 – Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Vulnerable until 5.6.7 per CVE record; stored XSS via Creative Button widget occurs with authenticated attackers at contributor level or higher. Connected sources confirm the is...

CVE-2024-0427

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions...

CVE-2024-5892 Divi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘supportunfilteredfilesupload’ function in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-5892

CVE-2024-5892 affects Divi Torque Lite – Divi Theme and Extra Theme (WordPress) up to version 3.6.6. The vulnerability is a stored Cross‑Site Scripting (XSS) flaw in the SVG/filtered file upload path via the function support_unfiltered_files_upload, exploitable by authenticated users with Author ...

CVE-2024-3559

The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfspostcontent' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2024-3559

The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfspostcontent' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2024-4564

The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due to...

CVE-2024-4564

CVE-2024-4564 affects CoDesigner – Elementor Addon for WooCommerce (WordPress) up to version 4.4.1. A stored XSS vulnerability exists in multiple widgets (Shop Slider, Tabs Classic, Image Comparison) due to insufficient input sanitization/output escaping. Exploitation requires at least Contributo...

CVE-2024-5553

CVE-2024-5553 affects Premium Addons for Elementor for WordPress (versions up to and including 4.10.33). It is a DOM-Based Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can i...

CVE-2024-4892 BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘displayname’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVE-2024-4892

CVE-2024-4892 affects BuddyPress for WordPress. A stored XSS via the display_name parameter exists in BuddyPress versions up to 12.4.1, exploitable by authenticated users with Subscriber+ privileges. The vulnerability context indicates input sanitization/output escaping is insufficient, allowing ...

12 Step Meeting List < 3.14.34 - Reflected Cross-Site Scripting

Description The 12 Step Meeting List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 3.14.33 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library < 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping on...

Kognetiks Chatbot for WordPress < 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

PT-2024-35406 · WordPress · Download Manager Pro

Name of the Vulnerable Software and Affected Versions: Download Manager Pro plugin for WordPress versions up to, and including, 3.2.92 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in certain shortcodes, including wpdm user...

WordPress plugin ARForms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-15550 · WordPress · Arforms

Name of the Vulnerable Software and Affected Versions: ARForms - Premium WordPress Form Builder Plugin version 6.4.0 and earlier Description: The issue arises from the improper escaping of user-controlled input when it is reflected in some of the plugin's AJAX actions. This can lead to potential...

WordPress plugin Social Sharing security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...