CVE-2024-2783: Improper Neutralization of Input During Web Page Generation

The GamiPress – The 1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escapin...

CVE-2024-2845: Improper Neutralization of Input During Web Page Generation

The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.2 due to insufficient input...

CVE-2024-1424: Improper Neutralization of Input During Web Page Generation

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-22441 · WordPress · The Betterdocs

Name of the Vulnerable Software and Affected Versions: The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg versions up to, and including, 3.4.2 Description: The issue arises from insufficient input sanitization and output...

PT-2024-24754 · WordPress · Bold Page Builder

Name of the Vulnerable Software and Affected Versions: The Bold Page Builder plugin for WordPress versions up to, and including, 4.8.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the bt ...

CVE-2024-2436: Improper Neutralization of Input During Web Page Generation

The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-15170 · WordPress · The Pods – Custom Content Types/Fields

Name of the Vulnerable Software and Affected Versions: The Pods – Custom Content Types and Fields plugin for WordPress versions prior to 3.0.11, excluding versions 2.7.31.2, 2.8.23.2, and 2.9.19.2 Description: The issue allows authenticated attackers with contributor level access or higher to...

WordPress RSS Aggregator by Feedzy plugin <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Error Message vulnerability discovered by Colin Xu in WordPress Plugin Feedzy versions = 4.3.3...

WordPress Powerkit plugin <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

AuthenticatedContributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Powerkit versions = 2.9.1...

WordPress Bold Page Builder plugin <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via btbbpricelist Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Bold Page Builder versions = 4.8.8...

WordPress EmbedPress plugin <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by wesley wcraft in WordPress Plugin EmbedPress versions = 3.9.14...

ElementsKit Elementor addons < 3.0.6 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator < 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message

Description The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output...

WordPress Passster plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via contentprotector Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Passster versions = 4.2.6.4...

CVE-2024-2499: Improper Neutralization of Input During Web Page Generation

The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordions' shortcode in all versions up to, and including, 0.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-20689 · WordPress · Squelch Tabs/Accordions Shortcodes

Name of the Vulnerable Software and Affected Versions: Squelch Tabs and Accordions Shortcodes plugin for WordPress versions up to, and including, 0.4.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'accordions' shortcode due to insufficient input sanitization a...

WordPress Beaver Themer plugin <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode vulnerability

Authenticated Contributor+ Sensitive Information Exposure via shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Beaver Themer versions = 1.4.9...

WordPress TaxoPress plugin <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by stealthcopter in WordPress Plugin TaxoPress versions = 3.12.0...

WordPress Modal Popup Box plugin <= 1.5.2 - Authenticated (Contributor+) PHP Object Injection in awl_modal_popup_box_shortcode vulnerability

Authenticated Contributor+ PHP Object Injection in awlmodalpopupboxshortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Modal Popup Box versions = 1.5.2...

PT-2024-18357

Name of the Vulnerable Software and Affected Versions Responsive Tabs WordPress plugin versions prior to 4.0.7 Description The issue concerns a Stored Cross-Site Scripting flaw. It arises from the plugin's failure to validate and escape certain shortcode attributes before outputting them in a pag...