CVE-2024-5073

CVE-2024-5073 affects the WordPress plugin Essential Addons for Elementor (Lite) up to version 5.9.21, with Stored Cross-Site Scripting via the Twitter Feed component. The issue arises from insufficient input sanitization and output escaping, enabling authenticated attackers with Contributor+ pri...

CVE-2024-5327

PowerPack Addons for Elementor (PowerPack Lite for Elementor)

CVE-2024-5341

The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of the Heading Title widget in all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-5341 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget

The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of the Heading Title widget in all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-4356

The List categories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'categories' shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-3946

The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2024-3946

CVE-2024-3946 describes a stored cross-site scripting vulnerability in the WordPress plugin WP To Do (versions up to and including 1.3.0). The issue arises from insufficient input sanitization and output escaping in admin/settings handling, enabling an authenticated attacker with administrator-le...

CVE-2024-4356

CVE-2024-4356 affects the WordPress plugin List categories, vulnerable in all versions up to 0.4 due to insufficient input sanitization and output escaping on user-supplied attributes in the categories shortcode. This enables an authenticated attacker with contributor-level access or higher to in...

CVE-2024-5223

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-3190

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text field widget in all versions up to, and including, 1.5.107 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-2253

Stored XSS in Testimonial Carousel For Elementor (WordPress) across versions

CVE-2024-3063

CVE-2024-3063 refers to a Stored Cross‑Site Scripting (XSS) vulnerability in the WPB Elementor Addons WordPress plugin. Affected versions are all ≤ 1.0.9, due to insufficient input sanitization and output escaping on widget tag attributes. Exploitation requires authentication at contributor level...

CVE-2024-3190 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text field widget in all versions up to, and including, 1.5.107 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-3190

The CVE-2024-3190 entry concerns the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin. A Stored Cross-Site Scripting (XSS) flaw exists in the text field widget due to insufficient input sanitization and output escaping on user-supplied attributes, affecting all ...

CVE-2024-3063 WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the output of 'tags' added to widgets in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for...

CVE-2024-3063 WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the output of 'tags' added to widgets in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for...

CVE-2024-5223 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-5223

CVE-2024-5223 refers to the Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX for WordPress. It is a Stored Cross-Site Scripting (XSS) vulnerability in the plugin’s file uploading feature, affecting all versions up to and including 4.1.1 due to insufficient input sanitization and outpu...

CVE-2024-3726 Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcode

The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-3726

CVE-2024-3726 : The WordPress plugin “Login Logout Register Menu” is vulnerable to Stored Cross-Site Scripting via the llrmloginlogout shortcode in all versions up to 2.0 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or...