CVE-2024-4209

The vulnerability CVE-2024-4209 affects Gutenberg Blocks with AI by Kadence Blocks – Page Builder Features for WordPress. It is a Stored Cross-Site Scripting (XSS) via the countdown timer in versions up to 3.2.36, caused by insufficient input sanitization and output escaping on user-supplied attr...

CVE-2024-4574 Graphina – Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3956

CVE-2024-3956 (Pods – Custom Content Types and Fields, WordPress) is a stored XSS in the Pod Form Redirect URL triggered by authenticated users with contributor-level access or higher, affecting all versions up to 3.2.1. Root cause: insufficient input sanitization and output escaping on user-supp...

CVE-2024-4398 HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-4449

CVE-2024-4449 maps to a Stored Cross-Site Scripting vulnerability in the WordPress plugin Essential Addons for Elementor – Lite (the “Best Elementor Templates, Widgets, Kits & WooCommerce Builders”). Affected versions are all up to 5.9.19, with the issue caused by insufficient input sanitization ...

CVE-2024-4481 Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the plugin's blocks in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-4481

CVE-2024-4481 affects Gutenberg Blocks with AI by Kadence WP (WordPress). The WordPress plugin Kadence Blocks vulnerability allows Stored XSS via the link attribute in blocks across all versions up to 3.2.36. attacker requires at least contributor-level authentication to inject scripts into pages...

[SECURITY] Fedora 38 Update: python-dns-2.3.0-3.fc38

dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG authenticated messages and EDNS0. dnspython provides both high and low level access to DNS. The high level classes perform queries for data...

CVE-2024-2785 The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate widget in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2785

CVE-2024-2785 affects The Plus Addons for Elementor (WordPress). The issue is a Stored Cross-Site Scripting (XSS) in the Age Gate widget due to insufficient input sanitization and output escaping of user-supplied attributes. Affected versions are ≤ 5.4.2. Exploitation requires contributor-level a...

CVE-2024-1467

The CVE-2024-1467 vulnerability affects the Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress. It is a Server-Side Request Forgery (SSRF) vulnerability exploitable by authenticated attackers with contributor-level access and above via the ai_api_request() fu...

CVE-2024-4193 Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'testimonialcategory' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4567

CVE-2024-4567 (Themify Shortcodes) is a stored XSS in the Themify Shortcodes WordPress plugin up to version 2.0.9. The vulnerability stems from insufficient input sanitization and output escaping in the themify_button shortcode attributes, allowing an authenticated attacker with contributor-level...

CVE-2024-4567 Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2846

The CVE is for the Visual Footer Credit Remover WordPress plugin. It describes a Stored XSS via the selector parameter in all versions up to 2, caused by insufficient input sanitization and output escaping. The vulnerability requires authenticated, administrator-level access and affects multisite...

CVE-2024-3990 HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-3990

CVE-2024-3990 applies to HT Mega – Absolute Addons For Elementor for WordPress. It is a Stored Cross-Site Scripting vulnerability in the Tooltip & Popover Widget present in all versions up to and including 2.5.0, caused by insufficient input sanitization and output escaping on user-supplied attri...

CVE-2024-3990 HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-4542

CVE-2024-4542 is rejected and not used; please refer to CVE-2024-3548 instead.

CVE-2024-2923

CVE-2024-2923 affects Magical Addons For Elementor (Header Footer Builder, Free Elementor Widgets, Elementor Templates Library) for WordPress. It is a Stored XSS via the Text Effect Widget in all versions up to v1.1.37 due to insufficient input sanitization/escaping; requires authenticated access...