PT-2024-16382

Name of the Vulnerable Software and Affected Versions Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress versions up to, and including, 1.20.2 Description The issue is related to Stored Cross-Site Scripting via the post title...

PT-2024-17344

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress versions up to, and including, 1.9.5 Description The issue is related to Stored Cross-Site Scripting via the attire-blocks/post-carousel block due to insufficient input...

CVE-2024-12172: Missing Authorization

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpcupdateusermetaoption function in all versions up to, and including, 3.2.21. This makes it...

PT-2024-16968

Name of the Vulnerable Software and Affected Versions YooBar plugin for WordPress versions up to, and including, 2.0.6 Description The YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings due to insufficient input sanitization and output escaping. This...

PT-2024-16097

Name of the Vulnerable Software and Affected Versions Cognito Forms plugin for WordPress versions up to, and including, 2.0.6 Description The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2024-16949

Name of the Vulnerable Software and Affected Versions Arena.IM – Live Blogging for real-time events plugin for WordPress versions up to, and including, 0.3.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode due to insufficient input sanitizati...

PT-2024-17230

Name of the Vulnerable Software and Affected Versions ONLYOFFICE DocSpace plugin for WordPress versions up to, and including, 2.1.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode due to insufficient input sanitization and output...

PT-2024-17253

Name of the Vulnerable Software and Affected Versions Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress versions prior to 4.7 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode due to insufficient input sanitization and output...

PT-2024-17257

Name of the Vulnerable Software and Affected Versions Integrate Firebase plugin for WordPress versions up to and including 0.9.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'firebase show' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-17326

Name of the Vulnerable Software and Affected Versions Perfect Font Awesome Integration plugin for WordPress versions up to and including 2.3 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'pfai' shortcode. This...

CVE-2024-11760: Improper Neutralization of Input During Web Page Generation

The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

PT-2024-17242

Name of the Vulnerable Software and Affected Versions WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress versions up to, and including, 1.3.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'gs book showcas...

PT-2024-16804

Name of the Vulnerable Software and Affected Versions Greenshift – animation and page builder blocks plugin for WordPress versions up to, and including, 9.9.9.3 Description The issue concerns insufficient restrictions on which posts can be included via the wp reusable render shortcode. This allow...

CVE-2024-12406: Improper Neutralization of Special Elements used in an SQL Command

The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the 'owt7borrowbooksid' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2024-11442: Improper Neutralization of Input During Web Page Generation

The Horizontal scroll image slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'horizontal-scroll-image-slideshow' shortcode in all versions up to, and including, 10.1 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-11410: Improper Neutralization of Input During Web Page Generation

The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This mak...

CVE-2024-11413: Improper Neutralization of Input During Web Page Generation

The HostFact bestelformulier integratie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bestelformulier' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-11766: Improper Neutralization of Input During Web Page Generation

The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gsbookshowcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output...

CVE-2024-11750: Improper Neutralization of Input During Web Page Generation

The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-17523

Name of the Vulnerable Software and Affected Versions 360 Javascript Viewer plugin for WordPress versions up to, and including, 1.7.29 Description The issue is related to Stored Cross-Site Scripting via the ref parameter due to insufficient input sanitization and output escaping. This allows...