PT-2021-16005

Name of the Vulnerable Software and Affected Versions Related Posts for WordPress plugin versions 2.0.4 and earlier Description The issue allows high privilege users, such as admins, to set XSS payloads in the heading text and CSS settings due to a lack of sanitization, leading to Stored Cross-Si...

CVE-2021-24292

The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site ScriptingXSS by lower-privileged users such as contributors, all via a similar method: The “Card” widget...

Related Posts for WordPress < 2.0.5 - Authenticated Stored XSS & XFS

The plugin does not sanitise its headingtext and css settings, allowing high privilege users admin to set XSS payloads in them, leading to Stored Cross-Site Scripting issues. PoC Payloads: $ m0ze"...

CVE-2021-24202

In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget includes/widgets/heading.php accepts a ‘headersize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifie...

Design/Logic Flaw

In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget includes/widgets/heading.php accepts a ‘headersize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifie...

CVE-2021-24202

In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget includes/widgets/heading.php accepts a ‘headersize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifie...

CVE-2021-24202: Improper Neutralization of Input During Web Page Generation

In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget includes/widgets/heading.php accepts a ‘headersize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifie...

WordPress插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. plugin for WordPress. A security vulnerability exists in the WordPress plugin Elementor Website Builder prior to version 3.1.4 that stems from the heading widget includes/widgets/heading.php accepting the headersize parameter...

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget

In the plugin, the heading widget includes/widgets/heading.php accepts a ‘headersize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request with this parameter set t...

Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget

In the plugin, the heading widget includes/widgets/heading.php accepts a ‘headersize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request with this parameter set t...

VulnCheck KEV: CVE-2021-24202

In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget includes/widgets/heading.php accepts a ‘headersize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifie...

Cross site scripting

In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS...

CVE-2020-13761: Improper Neutralization of Input During Web Page Generation

In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS...

CVE-2017-18600

The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form Heading Heading Text" field...

Design/Logic Flaw

The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form Heading Heading Text" field...

CVE-2017-18600

The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form Heading Heading Text" field...

PT-2019-8531

Name of the Vulnerable Software and Affected Versions formcraft3 plugin versions prior to 3.4 for WordPress Description The issue is related to stored XSS, which occurs via the "New Form Heading Heading Text" field. This allows for malicious input to be stored and executed, potentially leading to...

CVE-2017-18600: Improper Neutralization of Input During Web Page Generation

The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form Heading Heading Text" field...

CVE-2018-10763

Multiple cross-site scripting XSS vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the 1 Main heading or 2 Sub heading fields in the Partial Branding configuration page...

CVE-2018-10763: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the 1 Main heading or 2 Sub heading fields in the Partial Branding configuration page...