CVE-2024-1411

CVE-2024-1411 affects PowerPack Addons for Elementor (WordPress). The vulnerability is a Stored Cross‑Site Scripting (XSS) in the Twitter Buttons Widget, exploitable via its settings. Affected versions are up to and including 2.7.15. Exploitation requires at least contributor‑level access by an a...

CVE-2024-1277

CVE-2024-1277 affects Ocean Extra for WordPress up to version 2.2.4, enabling Stored XSS via custom fields due to insufficient input sanitization and output escaping. Exploitation requires authentication (contributor+). A fix is available in version 2.2.5; upgrade Ocean Extra to 2.2.5 or later to...

CVE-2024-1044

CVE-2024-1044 concerns the WordPress plugin “Customer Reviews for WooCommerce.” The root cause is a missing capability check in the submit_review function across all versions up to and including 5.38.12, which allows unauthenticated attackers to submit reviews with arbitrary emails, regardless of...

CVE-2024-0506

Elementor Website Builder for WordPress (WordPress plugin) is vulnerable to Cross‑Site Scripting via the get_image_alt path in versions

CVE-2024-0513

CVE-2024-0513 affects Royal Elementor Addons and Templates for WordPress up to version 1.3.87, due to missing/incorrect nonce validation in remove_from_wishlist, enabling unauthenticated CSRF to remove items from user wishlists if a site admin is tricked into clicking a forged link. Patch availab...

CVE-2024-1337

The CVE-2024-1337 advisory concerns the WordPress SKT Page Builder plugin. A missing capability check in saveSktbuilderPageData affects all versions up to and including 4.1, permitting authenticated users with subscriber access or higher to inject arbitrary content and modify data on pages. Pract...

CVE-2024-1340

CVE-2024-1340 affects the WordPress plugin Login Lockdown – Protect Login Form (

CVE-2023-6923

The CVE-2023-6923 involves the Matomo Analytics – Ethical Stats. Powerful Insights. WordPress plugin. Affected: WordPress Matomo plugin up to version 4.15.3. Root cause: insufficient input sanitization and output escaping in the idsite parameter, enabling Reflected Cross-Site Scripting. Impact: u...

CVE-2023-6565

The CVE-2023-6565 issue affects the InfiniteWP Client WordPress plugin (versions

CVE-2024-1339

CVE-2024-1339 affects the WordPress plugin ImageRecycle pdf & image compression (versions

CVE-2024-0379

CVE-2024-0379 - CSRF in Custom Twitter Feeds (WordPress) up to version 2.2.1 stems from missing/incorrect nonce validation in the ctf_auto_save_tokens function. This allows unauthenticated attackers to forge requests and update a site’s Twitter API token and secret if the admin is duped into perf...

CVE-2024-1128

CVE-2024-1128 affects the WordPress Tutor LMS plugin (versions up to and including 2.6.0). The vulnerability is HTML Injection in the Q&A functionality caused by insufficient sanitization of HTML input, allowing authenticated users with Student-level access and above to inject arbitrary HTML onto...

CVE-2024-0442

CVE-2024-0442 affects Royal Elementor Addons and Templates for WordPress (versions

CVE-2023-6806

CVE-2023-6806 — Starbox plugin for WordPress stores XSS via Job Settings fields in all versions up to 3.4.8. Root cause: insufficient input sanitization/output escaping allows authenticated users with subscriber+ privileges to inject script executed by other users. Mitigation: upgrade to the fixe...

CVE-2024-1448

The CVE-2024-1448 entry concerns the WordPress Social Sharing Plugin – Sassy Social Share. A stored XSS vulnerability exists in all versions up to 3.3.56 due to insufficient input sanitization and output escaping on shortcode attributes, allowing authenticated attackers with contributor-level or ...

CVE-2024-0983

CVE-2024-0983 affects the ImageRecycle pdf & image compression WordPress plugin (versions

CVE-2024-1447

The Sydney Toolbox WordPress plugin (up to version 1.25) is vulnerable to stored XSS via the aThemes Slider button, caused by insufficient input sanitization and output escaping of user-supplied links. Authenticated attackers with contributor-level permissions can inject scripts that execute when...

CVE-2024-0602

The CVE-2024-0602 entry concerns the YARPP – Yet Another Related Posts Plugin for WordPress. Affected: YARPP versions up to and including 5.30.9. Root cause: insufficient input sanitization and output escaping in admin settings, enabling Stored Cross-Site Scripting. Impact: authenticated attacker...

CVE-2024-1242

The CVE-2024-1242 entry affects Premium Addons for Elementor (WordPress). Root cause: stored XSS via the button onclick attribute due to insufficient input sanitization and output escaping, exploitable by authenticated users with Contributor+ privileges. Affected versions: up to 4.10.18. Impact d...

CVE-2024-0792

CVE-2024-0792 affects the WordPress WP Shortcodes Plugin — Shortcodes Ultimate up to version 7.0.1. The issue is stored XSS via the plugin’s shortcodes in RSS feed content due to insufficient input sanitization and output escaping. Exploitation requires authentication at contributor level or high...