PT-2024-34930

Name of the Vulnerable Software and Affected Versions Moka Get Posts Shortcode versions 1.0 and earlier Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This is a DOM-Based XSS vulnerability, which can be...

CVE-2024-11036: Improper Control of Generation of Code

The The GamiPress – The 1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipressgetuserearnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing...

CVE-2024-51864: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Agnel Waghela Shortcode Collection shortcode-collection allows Stored XSS.This issue affects Shortcode Collection: from n/a through = 1.4...

WordPress plugin Geoportail Shortcode Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Plugin Shortcode Collection Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-16720

Name of the Vulnerable Software and Affected Versions GamiPress versions up to, and including, 7.1.5 Description The issue allows arbitrary shortcode execution via the gamipress get user earnings AJAX action. This is due to the software allowing users to execute an action that does not properly...

CVE-2024-51904: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Joan Boluda Embed documents shortcode embed-documents-shortcode allows Stored XSS.This issue affects Embed documents shortcode: from n/a through = 1.5...

PT-2024-35057

Name of the Vulnerable Software and Affected Versions Sazzad Hu Testimonial Slider Shortcode versions 1.1.9 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker ca...

CVE-2024-51855: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Productineer Redirecter shortcode-for-redirection allows DOM-Based XSS.This issue affects Redirecter: from n/a through = 1.0...

PT-2024-34994 · Unknown · Agnel Waghela Shortcode Collection

Name of the Vulnerable Software and Affected Versions: Agnel Waghela Shortcode Collection versions 1.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

CVE-2024-11195: Improper Neutralization of Input During Web Page Generation

The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's printemailsubscribeform shortcode in all versions up to, and including, 1.2.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-16147 · Sonaar · Mp3 Audio Player – Music Player

Name of the Vulnerable Software and Affected Versions: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress versions up to, and including, 5.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's sonaar audioplayer shortcode due t...

WordPress plugin: Embed shortcode; cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-34970 · Unknown · Sazzad Hu Image Carousel Shortcode

Name of the Vulnerable Software and Affected Versions: Sazzad Hu Image Carousel Shortcode versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that the...

PT-2024-16721 · WordPress · Wpb Popup For Contact Form 7

Name of the Vulnerable Software and Affected Versions: WPB Popup for Contact Form 7 versions 1.7.5 and earlier Description: The issue is related to arbitrary shortcode execution via the wpb pcf fire contact form AJAX action. This is due to the software allowing users to execute an action that doe...

PT-2024-35029

Name of the Vulnerable Software and Affected Versions Sachin Jadhav Semantic Shortcode versions n/a through 1.0.1 Description The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious scripts...

PT-2024-35021

Name of the Vulnerable Software and Affected Versions geoWP Geoportail Shortcode versions through 2.4.4 Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This can be exploited by attackers. The...

WordPress plugin Boombox Shortcode has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-51827: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Movement Ventures Boombox Shortcode boombox-shortcode allows DOM-Based XSS.This issue affects Boombox Shortcode: from n/a through = 1.0.0...

CVE-2024-51810: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in George Lewe Lewe Bootstrap Visuals shortcode-bootstrap-visuals allows Stored XSS.This issue affects Lewe Bootstrap Visuals: from n/a through = 3.0.1...