CVE-2024-12420: Improper Control of Generation of Code

The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-11012: Improper Control of Generation of Code

The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njtnofitext AJAX action in all versions up to, and including, 2.1.4. This is due to the software allowing users to execute an action that does not properly validate a value...

PT-2024-17243 · WordPress · Newsmanapp

Name of the Vulnerable Software and Affected Versions: NewsmanApp plugin for WordPress versions up to, and including, 2.7.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'newsman subscribe widget' shortcode due to insufficient input sanitization and output...

CVE-2024-12417: Improper Control of Generation of Code

The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible...

PT-2024-17588 · WordPress · Wpmobile.App

Name of the Vulnerable Software and Affected Versions: WPMobile.App — Android and iOS Mobile Application plugin for WordPress versions up to, and including, 11.52 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software permitting users to execut...

PT-2024-17606 · WordPress · Property Hive Stamp Duty Calculator

Name of the Vulnerable Software and Affected Versions: Property Hive Stamp Duty Calculator plugin for WordPress versions up to, and including, 1.0.22 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'stamp duty calculator scotland' shortcode due to insufficient...

WordPress plugin SVG Shortcode cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

PT-2024-17233 · WordPress · Trafft

Name of the Vulnerable Software and Affected Versions: Booking System Trafft plugin for WordPress versions up to, and including, 1.0.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'trafftbooking' shortcode due to insufficient input sanitization and output...

PT-2024-17586 · WordPress · Simple Link Directory

Name of the Vulnerable Software and Affected Versions: Simple Link Directory plugin for WordPress versions up to, and including, 8.4.0 Description: The issue arises from the software allowing users to execute an action that does not properly validate a value before running do shortcode, making it...

WordPress Notibar – Notification Bar for WordPress plugin <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution via njtnofitext vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Notibar versions = 2.1.4...

WordPress Coupon Affiliates plugin <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting vulnerability

Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Coupon Affiliates versions = 5.16.7.1...

WordPress WPMobile.App plugin <= 11.52 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin WPMobile.App versions = 11.52...

WordPress Simple Link Directory plugin <= 8.4.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Simple Link Directory versions = 8.4.0...

WordPress SVG Shortcode plugin <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG Upload vulnerability discovered by Pierre Rudloff in WordPress Plugin SVG Shortcode versions = 1.0.1...

WordPress WoodMart plugin <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Theme WoodMart versions = 8.0.3...

WordPress Geoportail Shortcode plugin <= 2.4.4 - CSRF to Stored Cross-Site Scripting vulnerability

CSRF to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Geoportail Shortcode versions = 2.4.4...

CVE-2024-12333

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the woodmartinstagramajaxquery AJ...

CVE-2024-12333 WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the woodmartinstagramajaxquery AJ...

CVE-2024-12333

CVE-2024-12333 affects the Woodmart WordPress theme. The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes via the woodmart_instagram_ajax_query AJAX action because a value is not properly validated before running do_shortcode. This is a shortcode execution flaw in al...

CVE-2024-12333 WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the woodmartinstagramajaxquery AJ...