15959 matches found
CVE-2024-4379
The CVE-2024-4379 vulnerability affects Premium Addons for Elementor (WordPress) and is a DOM-based Stored Cross-Site Scripting issue in the Global Tooltip widget. It exists in all versions up to 4.10.31 due to insufficient input sanitization and output escaping on user-supplied attributes. Explo...
CVE-2024-4376
CVE-2024-4376 concerns the Premium Addons for Elementor WordPress plugin. The connected data confirms a Stored Cross-Site Scripting (Stored XSS) vulnerability in the Fancy Text widget, affecting all versions up to 4.10.31 due to insufficient input sanitization and output escaping. Exploitation re...
CVE-2024-4376 Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-2793
CVE-2024-2793 refers to the Visual Website Collaboration, Feedback & Project Management – Atarim WordPress plugin. The vulnerability is an unauthenticated Stored Cross-Site Scripting (XSS) via comments in all versions up to 3.30, caused by insufficient input sanitization and output escaping. Impa...
CVE-2024-5418
The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin's De Product Tab & Slide widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied...
CVE-2024-5418 DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute
The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin's De Product Tab & Slide widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied...
CVE-2024-5418 DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute
The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin's De Product Tab & Slide widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied...
CVE-2024-5418
CVE-2024-5418 : The DethemeKit For Elementor WordPress plugin has a Stored Cross-Site Scripting (XSS) flaw in the De Product Tab & Slide widget via the slitems attribute. The issue affects all versions up to 2.1.4 due to insufficient input sanitization and output escaping for user-supplied attrib...
Contact Form Manager < 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xyz-cfm-form shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
Content Blocks (Custom Post Widget) < 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode
Description The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'contentblock' shortcode in all versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This...
Moodle Security Breach
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from insufficient parameter escaping, resulting in a stored cross-site scripting...
Royal Elementor Addons and Templates < 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, image accordion, off canvas, woogrid, and product mini cart widgets in all versions up to, and including, 1.3.975 due to insufficient input...
PT-2024-36079 · WordPress · Dethemekit For Elementor
Name of the Vulnerable Software and Affected Versions: DethemeKit For Elementor plugin for WordPress versions up to, and including, 2.1.4 Description: The issue is related to Stored Cross-Site Scripting via the slitems attribute within the plugin's De Product Tab & Slide widget. This is due to...
WordPress Plugin 'Yoast SEO' < 22.7 XSS
The WordPress application running on the remote host has a version of the 'Yoast SEO' plugin that is prior to 22.7. It is, therefore, affected by a stored cross-site scripting XSS vulnerability due to insufficient input sanitization and output escaping. An authenticated attacker with...
WordPress Infinite Scroll – Ajax Load More < 7.1.2 - Authenticated (Contributor+) Cross-Site Scripting
Description The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajaxloadmore shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
Starter Templates — Elementor, WordPress & Beaver Builder Templates < 4.2.2 - Contributor+ Stored Cross-Site Scripting
Description The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customuploadmimes’ function in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes...
Page Builder Gutenberg Blocks – CoBlocks < 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Profiles
Description The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Social Profiles widget in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...
USN-6801-1 python-pymysql vulnerability
It was discovered that PyMySQL incorrectly escaped untrusted JSON input. An attacker could possibly use this issue to perform SQL injection attacks...
CVE-2024-3583
The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...