CVE-2024-2311

CVE-2024-2311 affects Avada (WordPress theme) up to version 7.11.6. The vulnerability is a Stored XSS via plugin shortcodes due to insufficient input sanitization and output escaping of user-supplied shortcode attributes. Exploitation requires contributor-level or higher authentication, and affec...

CVE-2024-2138

CVE-2024-2138 concerns the WordPress plugin JetWidgets For Elementor. The Red Hat and Wordfence entries describe a stored cross-site scripting (XSS) vulnerability in the Animated Box widget, affecting all versions up to and including 1.0.15. The issue arises from insufficient input sanitization a...

CVE-2024-2957

CVE-2024-2957 is a duplicate of CVE-2024-1983. The linked Red Hat/NVD details show Simple Ajax Chat for WordPress (before 20240223) suffers a stored XSS via the name field, reflecting unsanitized input to other users. This confirms the vulnerability context, affected component, and root cause; CV...

CVE-2024-2347

CVE-2024-2347 concerns the Astra WordPress theme. It is a Stored Cross-Site Scripting (XSS) via a user’s display name in all versions up to and including 4.6.8, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher...

CVE-2024-2341

CVE-2024-2341 refers to the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments (plugin) with SQL Injection via the keys parameter in all versions up to 1.6.7.7, allowing authenticated subscribers to append queries and potentially exfiltrate data. Red Hat and NVD entries ...

CVE-2024-1984

CVE-2024-1984 affects the WordPress Graphene theme (versions ≤ 2.9.2). The issue allows unauthenticated users to access post contents of password-protected posts via a meta tag in the page source, indicating a missing authorization check (low-severity info exposure). Reported by Krzysztof Zając a...

CVE-2024-1461

Elementor Addons by Livemesh (WordPress) contains a Stored XSS in Team Members widget via the style attribute in all versions up to 8.3.4 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor+ access can inject scripts that execute for users visiting...

CVE-2024-1812

CVE-2024-1812 affects the Everest Forms plugin for WordPress, enabling Server-Side Request Forgery via the font_url parameter in all versions up to and including 2.0.7. This allows unauthenticated attackers to issue web requests from the vulnerable site to internal or arbitrary locations, potenti...

CVE-2024-2344

CVE-2024-2344 (Avada Theme for WordPress) : SQL Injection via the 'entry' parameter affects all versions up to 7.11.6. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Exploitation requires editor-level access or higher (authenticated). Impact ...

CVE-2024-2117

CVE-2024-2117 affects Elementor Website Builder – More than Just a Page Builder (WordPress) via the Path Widget. All versions up to 3.20.2 are vulnerable due to insufficient output escaping on user-supplied attributes, enabling stored XSS. Exploitation requires an authenticated attacker with cont...

CVE-2024-2504

CVE-2024-2504 affects Page Builder: Pagelayer (WordPress plugin) up to version 1.8.4. The vulnerability is a stored XSS via the attr parameter caused by insufficient input sanitization/output escaping. Impact: authenticated users with Contributor+ can inject scripts that execute when any user loa...

CVE-2024-1424

CVE-2024-1424 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress. All versions up to 3.5.1 are vulnerable to Stored Cross-Site Scripting via shortcode attributes due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-l...

CVE-2024-2222

CVE-2024-2222 (Advanced Classifieds & Directory Pro for WordPress) : Vulnerability due to a missing capability check in ajax_callback_delete_attachment across all versions up to 3.0.0. This allows authenticated users with subscriber+ access to delete arbitrary media uploads, i.e., unauthorized da...

CVE-2024-1587

CVE-2024-1587 affects the WordPress Newsmatic theme up to version 1.3.0. It enables Sensitive Information Exposure via the newsmatic_filter_posts_load_tab_content, allowing unauthenticated users to view draft posts and post content. The CVSS v3.1 base score is 5.3 (Medium) with network attack vec...

CVE-2024-2623

The CVE-2024-2623 entry concerns the WordPress plugin “Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders.” Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in the countdown widget’s message parameter caused by insufficient i...

CVE-2024-1999

The WordPress plugin Gutenberg Blocks by Kadence Blocks – Page Builder Features is affected by CVE-2024-1999: Stored XSS via the Testimonial Widget anchor style parameter in versions up to 3.2.25. Exploitation requires at least Contributor‑level access and can lead to stored scripts executing on ...

CVE-2024-2287

CVE-2024-2287 — Knight Lab Timeline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in versions up to 3.9.3.3 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions (or higher) can inject sc...

CVE-2024-2305

CVE-2024-2305 concerns the WordPress plugin Cards for Beaver Builder. The vulnerability is described as a Stored Cross-Site Scripting (XSS) via the BootstrapCard link in versions up to and including 1.1.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. ...

CVE-2024-1893

CVE-2024-1893 affects the Easy Property Listings WordPress plugin. Time-based SQL Injection is possible in all versions up to 3.5.2 due to insufficient escaping of the property_status shortcode parameter and inadequate query preparation. Authenticated attackers with Contributor+ privileges can in...

CVE-2024-2507

CVE-2024-2507 affects JetWidgets For Elementor plugin for WordPress. All versions up to and including 1.0.16 are vulnerable to Stored Cross-Site Scripting via the widget button URL due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authen...