CVE-2024-5003

The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-4042

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficient input...

CVE-2024-5003 WP Stacker <= 1.8.5 - Stored XSS via CSRF

The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-4042 Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficient input...

CVE-2024-4042

CVE-2024-4042 affects the WordPress plugins Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks. It is a Stored Cross-Site Scripting via the menu-wrap-item block attribute, caused by insufficient input sanitization/output escaping, in all versions up ...

CVE-2024-5640

The Prime Slider – Addons For Elementor Revolution of a slider, Hero Slider, Ecommerce Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ attribute within the Pacific widget in all versions up to, and including, 3.14.7 due to insufficient input sanitization and...

CVE-2024-5640

CVE-2024-5640 affects the Prime Slider – Addons For Elementor plugin (bdthemes-prime-slider-lite) for WordPress. The issue is a Stored Cross‑Site Scripting via the Pacific Widget’s id attribute in all versions up to and including 3.14.7 due to insufficient input sanitization and output escaping. ...

CVE-2024-5612

CVE-2024-5612 affects Essential Addons for Elementor Pro (WordPress). A stored XSS flaw exists in the Lightbox & Modal widget via the eael_lightbox_open_btn_icon parameter in versions up to 5.8.15. An authenticated attacker with Contributor-level access or higher can inject scripts that execute w...

CVE-2024-5425

The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-1988 Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute in blocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output...

CVE-2024-5425 WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute

The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-1988

CVE-2024-1988 affects the WordPress plugins Post Grid / Combo Blocks (and related blocks) up to version 2.2.80, with stored XSS via the tag attribute in blocks due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (Contributor+), enabling injection...

CVE-2024-5425 WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute

The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-5425

CVE-2024-5425 affects the WP jQuery Lightbox plugin for WordPress. It allows stored XSS via the title attribute in all versions up to 1.5.4 due to insufficient input sanitization and output escaping. Exploitation requires authentication at Contributor level or higher, enabling injected scripts to...

CVE-2024-1768

The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and including, 25.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2024-3987

The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2024-3987 WP Mobile Menu – The Mobile-Friendly Responsive Menu <= 2.8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alt

The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2024-3987

CVE-2024-3987 : The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored XSS via image alt text in all versions up to 2.8.4.2, caused by insufficient input sanitization and output escaping. The vulnerability could be triggered by an authenticated attac...

CVE-2024-1768

CVE-2024-1768 – Clever Fox WordPress plugin : The WordPress plugin Clever Fox is affected by a Stored Cross-Site Scripting vulnerability in the plugin’s info box block, arising from insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers wi...

PT-2024-33870 · WordPress · Wp Stacker

Name of the Vulnerable Software and Affected Versions: WP Stacker WordPress plugin versions 1.8.5 and earlier Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS payload...