Colibri Page Builder < 1.0.277 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-29648 · WordPress · Album/Image Gallery Plus Lightbox

Name of the Vulnerable Software and Affected Versions: The Album and Image Gallery plus Lightbox plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does no...

CVE-2024-4743: Improper Neutralization of Special Elements used in an SQL Command

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlmsfavorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-4939: Improper Neutralization of Input During Web Page Generation

The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and including, 6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

PT-2024-33501

Name of the Vulnerable Software and Affected Versions Weaver Xtreme Theme Support plugin for WordPress versions up to, and including, 6.4 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's div shortcode, allowing...

CVE-2024-5485

The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Trigger Link shortcode in all versions up to, and including, 1.0.47 due to insufficient input sanitization and output escaping on user...

WordPress SureTriggers plugin <= 1.0.47 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Trigger Link Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin OttoKit versions = 1.0.47...

WordPress tagDiv Composer plugin <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via button Shortcode vulnerability discovered by Truoc Phan in WordPress Plugin tagDiv Composer versions = 4.8...

CVE-2024-5485: Improper Neutralization of Input During Web Page Generation

The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Trigger Link shortcode in all versions up to, and including, 1.0.47 due to insufficient input sanitization and output escaping on user...

CVE-2024-4273: Improper Neutralization of Input During Web Page Generation

The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'erepropertymap' shortcode in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3230: Improper Neutralization of Input During Web Page Generation

The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3888: Improper Neutralization of Input During Web Page Generation

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode vulnerability

Authenticated Contributor+ Local File Inclusion via Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Content Blocks Custom Post Widget versions = 3.3.0...

PT-2024-36429

Name of the Vulnerable Software and Affected Versions The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress versions up to, and including, 1.0.47 Description The issue is related to Stored Cross-Site Scripting via the plugin's Trigger Link shortcode...

PT-2024-24491

Name of the Vulnerable Software and Affected Versions Download Attachments plugin for WordPress versions up to, and including, 1.3 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the download-attachments shortcode. This allows...

PT-2024-28251

Name of the Vulnerable Software and Affected Versions tagDiv Composer plugin for WordPress versions up to, and including, 4.8 Description The issue is related to Stored Cross-Site Scripting via the plugin's button shortcode due to insufficient input sanitization and output escaping on user-suppli...

CVE-2024-3565

The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'contentblock' shortcode in all versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-4711

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajaxloadmore shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2024-26595

Name of the Vulnerable Software and Affected Versions Content Blocks Custom Post Widget plugin for WordPress versions up to, and including, 3.3.0 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's content block...

CVE-2024-4711: Improper Neutralization of Input During Web Page Generation

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajaxloadmore shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...