6005 matches found
CVE-2024-2287
CVE-2024-2287 — Knight Lab Timeline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in versions up to 3.9.3.3 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions (or higher) can inject sc...
CVE-2024-2305
CVE-2024-2305 concerns the WordPress plugin Cards for Beaver Builder. The vulnerability is described as a Stored Cross-Site Scripting (XSS) via the BootstrapCard link in versions up to and including 1.1.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. ...
CVE-2024-1893
CVE-2024-1893 affects the Easy Property Listings WordPress plugin. Time-based SQL Injection is possible in all versions up to 3.5.2 due to insufficient escaping of the property_status shortcode parameter and inadequate query preparation. Authenticated attackers with Contributor+ privileges can in...
CVE-2024-2507
CVE-2024-2507 affects JetWidgets For Elementor plugin for WordPress. All versions up to and including 1.0.16 are vulnerable to Stored Cross-Site Scripting via the widget button URL due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authen...
CVE-2024-2335
CVE-2024-2335 concerns the Elements Plus! WordPress plugin. Affected: Elements Plus! up to version 2.16.2. Issue: Stored Cross-Site Scripting via multiple widget link URLs caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers wi...
CVE-2024-2871
CVE-2024-2871 affects the Media Library Assistant plugin for WordPress. It enables SQL Injection via shortcode parameters in all versions up to 3.13 due to insufficient escaping and lack of proper query preparation, allowing authenticated attackers with contributor access or higher to append addi...
CVE-2024-1465
The CVE-2024-1465 entry concerns the Elementor Addons by Livemesh plugin for WordPress (versions up to and including 8.3.4). It describes a Stored Cross-Site Scripting vulnerability in the Posts Carousel widget via the carousel_skin attribute, arising from insufficient input sanitization and outp...
CVE-2024-1813
CVE-2024-1813 – Simple Job Board (WordPress) is a PHP Object Injection vulnerability in all versions up to 2.11.0, caused by deserialization of untrusted input in job_board_applicant_list_columns_value. It allows unauthenticated attackers to inject a PHP object; with a POP chain from another plug...
CVE-2024-2340
CVE-2024-2340 affects the WordPress Avada theme up to version 7.11.6. The vulnerability enables unauthenticated attackers to access sensitive files uploaded through Avada forms via the /wp-content/uploads/fusion-forms/ directory, causing sensitive information exposure. Root cause: directory listi...
CVE-2024-1790
The CVE CVE-2024-1790 affects WordPress Infinite Scroll – Ajax Load More plugin for WordPress (up to version 7.0.1). It enables Path Traversal via the type parameter, allowing authenticated attackers with administrator-level access and above to read arbitrary server files (Windows instances only)...
CVE-2024-0899
CVE-2024-0899 affects s2Member – Best Membership Plugin for WordPress. It enables Information Exposure via the API in all versions up to 230815, allowing unauthenticated access to post/page contents. Patch/update to 240315 or later to remediate. This entry is corroborated by multiple sources in t...
CVE-2024-2693
CVE-2024-2693 affects the Link Whisper Free WordPress plugin up to version 0.7.1. The vulnerability is a PHP Object Injection via deserialization of untrusted input in the mfn-page-items post meta value, exploitable by authenticated users with contributor-level access or higher to inject a PHP ob...
CVE-2024-1464
Elementor Addons by Livemesh (WordPress) has CVE-2024-1464: Stored XSS via the style attribute in the Posts Slider widget, affecting all versions up to 8.3.4 due to insufficient input sanitization/output escaping. Impact: authenticated users with contributor+ privileges can inject scripts that ru...
CVE-2024-2183
The issue is a stored XSS in Beaver Builder Addons by WPZOOM for WordPress, affecting all versions up to 1.3.4. The vulnerability arises from insufficient input sanitization and output escaping in the Heading widget, allowing authenticated attackers with contributor-level access+ to inject script...
CVE-2024-1991
CVE-2024-1991 affects the WordPress plugin RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. A missing capability check in update_users_role() exists in all versions up to 5.3.0.0, enabling authenticated users with subscriber-level access and above to elev...
CVE-2024-2186
CVE-2024-2186: Beaver Builder Addons by WPZOOM for WordPress is susceptible to Stored XSS via the Team Members widget in all versions
CVE-2024-2650
The CVE-2024-2650 issue affects the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders (Essential Addons for Elementor Lite). Root cause: Stored Cross-Site Scripting in the Woo Product Carousel widget due to insufficient input sanitiza...
CVE-2024-2738
CVE-2024-2738 affects Permalink Manager Lite and Permalink Manager Pro for WordPress. The vulnerability is a Reflected Cross-Site Scripting flaw via the URL parameter ‘s’ in multiple locations present up to version 2.4.3.1, caused by insufficient input sanitization and output escaping. Attackers ...
CVE-2024-1571
CVE-2024-1571 : WP Recipe Maker for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to 9.2.1 due to insufficient input sanitization and output escaping. Authenticated users with access to the recipe dashboard (admin by default, but roles can...