CVE-2024-9885

The CVE-2024-9885 entry covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin Widget or Sidebar Shortcode, exploitable via the plugin’s sidebar shortcode in all versions up to 0.6.1. Authenticated attackers with contributor-level access or higher can inject scripts that execu...

CVE-2024-8627 Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-8627 Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2024-9885 Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, and including, 0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-9886

CVE-2024-9886 affects the WordPress plugin WP Baidu Map, where the stored XSS vulnerability can be triggered via the plugin’s baidu_map shortcode in versions up to 1.2.2. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes, enabling authenticated u...

CVE-2024-9886 WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Baidu Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'baidumap' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9884

The CVE concerns the WordPress plugin T(-) Countdown. A stored XSS flaw exists via the plugin’s tminus shortcode in all versions up to 2.4.8, caused by insufficient input sanitization and output escaping on user-supplied attributes. It affects authenticated users with contributor-level access and...

PT-2024-39912 · WordPress · Wp Baidu Map

Name of the Vulnerable Software and Affected Versions: WP Baidu Map plugin for WordPress versions up to, and including, 1.2.2 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the baidu map shortcode. This allows authenticated...

PT-2024-39911 · WordPress · Widget/Sidebar Shortcode

Name of the Vulnerable Software and Affected Versions: Widget or Sidebar Shortcode plugin for WordPress versions up to and including 0.6.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'sidebar' shortcode, allowi...

CVE-2024-9505

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-10226

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10226

CVE-2024-10226 : Arconix Shortcodes for WordPress is vulnerable to Stored XSS via the box shortcode in versions ≤ 2.1.13 due to insufficient input sanitization and output escaping on user attributes. Exploitation requires authenticated access at contributor level or higher; injected scripts execu...

CVE-2024-9505

CVE-2024-9505 affects Beaver Builder – WordPress Page Builder (Plugin). The issue is a stored DOM-based XSS in the Button widget introduced by insufficient input sanitization and output escaping on user-supplied attributes, exploitable by authenticated attackers with contributor-level access and ...

CVE-2024-10181 Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode

The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newslettersvideo shortcode in all versions up to, and including, 4.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10266

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all versions up to, and including, 4.10.60 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10233

CVE-2024-10233 affects the SMS Alert Order Notifications – WooCommerce WordPress plugin. It is vulnerable in all versions up to and including 3.7.5 due to insufficient input sanitization and output escaping on the sa_subscribe shortcode attributes, enabling an authenticated attacker with contribu...

CVE-2024-10233 SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sasubscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-10266 Premium Addons for Elementor <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all versions up to, and including, 4.10.60 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10185

CVE-2024-10185 (StreamWeasels YouTube Integration for WordPress) affects all versions up to and including 1.3.2 of the plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in the sw-youtube-embed shortcode caused by insufficient input sanitization and output escaping on user-supplied ...

CVE-2024-10185 StreamWeasels YouTube Integration <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode

The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...