CVE-2024-4705 Testimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode

The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2350

CVE-2024-2350 affects Clever Addons for Elementor (WordPress). It is a Stored XSS via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to 2.1.9, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor leve...

CVE-2024-2350 Clever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets

The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-5224 Easy Social Like Box – Popup – Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardozafacebooklikebox' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-5224

CVE-2024-5224 affects the WordPress plugin “Easy Social Like Box – Popup – Sidebar Widget.” Connected sources confirm a Stored Cross-Site Scripting flaw in the plugin’s shortcode cardoza_facebook_like_box on all versions up to and including 4.0, caused by insufficient input sanitization and outpu...

CVE-2024-5001

The WordPress plugin Image Hover Effects for Elementor with Lightbox and Flipbox (up to version 3.0.2) is affected by a Stored Cross-Site Scripting vulnerability. The root cause is insufficient input sanitization and output escaping in the parameters _id, oxi_addons_f_title_tag, and content_descr...

CVE-2024-5001 Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters

The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id', 'oxiaddonsftitletag', and 'contentdescriptiontag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and outpu...

CVE-2023-6956 EasyAzon – Amazon Associates Affiliate Plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale

The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-cloaking-locale’ parameter in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-6956

CVE-2023-6956 concerns the EasyAzon – Amazon Associates Affiliate Plugin for WordPress. The vulnerability is a Reflected XSS in the easyazon-cloaking-locale parameter affecting all versions up to and including 5.1.0, caused by insufficient input sanitization and output escaping. This enables unau...

CVE-2024-4942

CVE-2024-4942 concerns the WordPress Custom Dash plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via admin settings in all versions up to and including 1.0.2. It requires an authenticated attacker with administrator-level permissions and above. The issue affects multisite install...

CVE-2024-4942 Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2024-4942 Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2024-5342 Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sipspopup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5342

The CVE-2024-5342 entry concerns the WordPress plugin Simple Image Popup Shortcode. It states a Stored XSS vulnerability in the sips_popup shortcode across all versions up to and including 1.0, caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation...

CVE-2024-5342 Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sipspopup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin Qi Addons For Elementor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress plugin Colibri Page Builder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-18289 · WordPress · Clever Fox

Name of the Vulnerable Software and Affected Versions: The Clever Fox plugin for WordPress version 25.2.0 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's info box block due to insufficient input sanitization and output escaping on user-supplied...

WordPress plugin SellKit security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-34169 · WordPress · Colibri Page Builder

Name of the Vulnerable Software and Affected Versions: Colibri Page Builder plugin for WordPress versions up to, and including, 1.0.276 Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input...