CVE-2024-2922

The CVE refers to Themesflat Addons For Elementor (WordPress) with a Stored XSS in widget tags due to insufficient input sanitization/output escaping. Exploitation requires authenticated access (Contributor+), enabling injection that executes on page view. Affected versions up to 2.1.1 (NVD descr...

CVE-2024-4364 Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-5324

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'importsettings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-5179

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'itemstyle' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

CVE-2024-5224

The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardozafacebooklikebox' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-4788

The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createbhfpost function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with...

CVE-2024-4705

The CVE-2024-4705 entry concerns the WordPress Testimonials Widget plugin. It is a Stored Cross-Site Scripting vulnerability in the testimonials shortcode, present in all versions up to and including 4.0.4, caused by insufficient input sanitization and output escaping on user-supplied attributes....

CVE-2024-5179 Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'itemstyle' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

CVE-2024-5001

The WordPress plugin Image Hover Effects for Elementor with Lightbox and Flipbox (up to version 3.0.2) is affected by a Stored Cross-Site Scripting vulnerability. The root cause is insufficient input sanitization and output escaping in the parameters _id, oxi_addons_f_title_tag, and content_descr...

CVE-2024-5001 Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters

The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id', 'oxiaddonsftitletag', and 'contentdescriptiontag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and outpu...

CVE-2024-5342 Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sipspopup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5342

The CVE-2024-5342 entry concerns the WordPress plugin Simple Image Popup Shortcode. It states a Stored XSS vulnerability in the sips_popup shortcode across all versions up to and including 1.0, caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation...

CVE-2024-4788

Technical details such as affected software versions, root cause, exploitability, and fixes are not provided in the supplied documents. Monitor official advisories and CVE updates for concrete, technical information.

CVE-2024-5324 XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'importsettings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

PT-2024-26781 · WordPress · The Quiz/Survey Master

Name of the Vulnerable Software and Affected Versions: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress versions up to, and including, 9.0.1 Description: The issue is related to SQL Injection via the question id parameter due to insufficient escaping on the user-suppli...

PT-2024-28704 · WordPress · Wp Mobile Menu

Name of the Vulnerable Software and Affected Versions: The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress versions up to, and including, 2.8.4.2 Description: The issue is related to Stored Cross-Site Scripting via image alt text due to insufficient input sanitization an...

Royal Elementor Addons and Templates < 1.3.977 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inlinelist’ parameter in versions up to, and including, 1.3.976 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2024-35713 · WordPress · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: The Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.109 Description: The issue is related to blind SQL Injection via the dataaddonID parameter due to insufficient escaping on the user-supplied paramete...

Envo Extra < 1.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

Description The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttoncssid’ parameter within the Button widget in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

GO-2024-2760 Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication in github.com/rancher/rancher

Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...