CVE-2024-11412 Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Shine PDF Embeder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shinepdf' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11432 SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The SuevaFree Essential Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'counter' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11432

CVE-2024-11432 corresponds to a stored XSS in the SuevaFree Essential Kit WordPress plugin (versions

CVE-2024-11414 RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The RecipePress Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Ingredients in all versions up to, and including, 2.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-10164 Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdmpppaylink shortcode in all versions up to, and including, 5.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-10164 Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdmpppaylink shortcode in all versions up to, and including, 5.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-9851

CVE-2024-9851: LSX Tour Operator WordPress plugin

CVE-2024-9851 LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

PT-2024-16766

Name of the Vulnerable Software and Affected Versions The Sky Addons for Elementor plugin for WordPress versions up to, and including, 2.6.2 Description The issue allows unauthorized modification of data, potentially leading to a denial of service, due to a missing capability check on the save...

CVE-2024-11354: Missing Authorization

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delytsingvid function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with...

CVE-2024-11414: Improper Neutralization of Input During Web Page Generation

The RecipePress Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Ingredients in all versions up to, and including, 2.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-9442: Improper Neutralization of Input During Web Page Generation

The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above...

PT-2024-16344

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions up to, and including, 2.8.9 Description The issue allows authenticated attackers with subscriber-level access and above...

PT-2024-16930

Name of the Vulnerable Software and Affected Versions The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress versions up to, and including, 3.3 Description The issue is related to unauthorized access of data due to a missing capability check on the get setting function. This...

PT-2024-16183

Name of the Vulnerable Software and Affected Versions The Stratum – Elementor Widgets plugin for WordPress versions up to, and including, 1.4.4 Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template da...

CVE-2024-10671: Authorization Bypass Through User-Controlled Key

The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the btnblock shortcode due to insufficient restrictions on which posts can be included. This makes it possible for...

CVE-2024-10532: Missing Authorization

The Bard Extra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bardxtraimportxml function in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2024-11428: Improper Neutralization of Input During Web Page Generation

The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11424: Improper Neutralization of Input During Web Page Generation

The Slick Sitemap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slick-sitemap' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

PT-2024-16555

Name of the Vulnerable Software and Affected Versions If-So Dynamic Content Personalization plugin for WordPress versions up to, and including, 1.9.2.1 Description The issue allows authenticated attackers with Contributor-level access and above to extract data from private or draft posts created...