PT-2024-30605

Name of the Vulnerable Software and Affected Versions SiteOrigin Widgets Bundle plugin for WordPress versions up to, and including, 1.60.0 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the siteorigin widget shortcode. This...

CVE-2024-4262: Improper Neutralization of Input During Web Page Generation

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-4896: Improper Neutralization of Input During Web Page Generation

The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-5025: Improper Neutralization of Input During Web Page Generation

The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all versions up to, and including, 1.11.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

SiteOrigin Widgets Bundle < 1.61.0 - Contributor+ Stored XSS via siteorigin_widget Shortcode

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Element Pack Elementor Addons < 5.6.2 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the customattributes value in widgets due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to...

PT-2024-34131

Name of the Vulnerable Software and Affected Versions: Memberpress plugin for WordPress versions up to, and including, 1.11.29 Description: The issue allows authenticated attackers with Contributor-level access and above to make web requests to arbitrary locations originating from the web...

CVE-2024-5031: Server-Side Request Forgery (SSRF)

The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary...

PT-2024-26896

Name of the Vulnerable Software and Affected Versions Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced plugin for WordPress versions up to, and including, 1.4.9 Description The issue is related to Stored Cross-Site Scripting via the plugin's tbex-version shortcode due to...

CVE-2024-4980: Improper Neutralization of Input During Web Page Generation

The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id', 'mixColor', 'backgroundColor', 'saveInCookies', and 'autoMatchOsTheme' parameters in all versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping...

CVE-2024-4362: Improper Neutralization of Input During Web Page Generation

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode in all versions up to, and including, 1.60.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

PT-2024-27135

Name of the Vulnerable Software and Affected Versions Print-O-Matic plugin for WordPress versions up to, and including, 2.1.10 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'print-me' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-2088: Exposure of Sensitive Information Through Data Queries

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 via the 'nxsgetExpSettings' function. This makes it possible for authenticated attackers, with subscriber access and above, to extract...

CVE-2024-3066: Improper Neutralization of Input During Web Page Generation

The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for...

Contact Form Plugin by Fluent Forms < 5.1.16 - Contributor+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additiona...

jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode

Description The jQuery T- Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2024-4809

Name of the Vulnerable Software and Affected Versions: WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress versions up to, and including, 27.2 Description: The issue exists due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's...

CVE-2024-3926: Improper Neutralization of Input During Web Page Generation

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customattributes value in widgets in all versions up to, and including, 5.6.1 due to insufficient input sanitization...

CVE-2024-4619

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘hoveranimation’ parameter in versions up to, and including, 3.21.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-4695

Move Addons for Elementor (WordPress) - CVE-2024-4695: Stored XSS in multiple widgets due to insufficient input sanitization/output escaping for user-supplied attributes. Affected all versions up to 1.3.1. Exploitation requires contributor-level+ authentication to inject scripts that execute when...