WordPress Quran Shortcode plugin <= 1.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Quran Shortcode versions = 1.5...

WordPress Display Terms Shortcode plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Display Terms Shortcode versions = 1.0.4...

WordPress Emoji Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Emoji Shortcode versions = 1.0.0...

WordPress AMP Img Shortcode plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin AMP Img Shortcode versions = 1.0.1...

WordPress ML Responsive Audio plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin ML Responsive Audio player with playlist Shortcode versions = 0.2...

WordPress Reftagger Shortcode Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Reftagger Shortcode Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51612 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 461153da6fea Credits SOPROBRO Required privilege Contributo...

WordPress AMP Img Shortcode Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software AMP Img Shortcode Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51576 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c1c14fcefae0 Credits SOPROBRO Required privilege Contributo...

WordPress Quran Shortcode Plugin <= 1.5 is vulnerable to SQL Injection

Software Quran Shortcode Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-51625 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID c3f04d230d13 Credits LVT-tholv2k Required privilege Contributor Published ...

WordPress plugin SIP Reviews Shortcode for WooCommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2024-37656 · WordPress · Sip Reviews Shortcode

Name of the Vulnerable Software and Affected Versions: SIP Reviews Shortcode for WooCommerce plugin for WordPress versions up to, and including, 1.2.3 Description: The issue is related to Stored Cross-Site Scripting via the no of reviews attribute in the "woocommerce reviews" shortcode. This is d...

WordPress Emoji Shortcode Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Emoji Shortcode Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51609 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6ec03d2b4a66 Credits SOPROBRO Required privilege Contributor...

WordPress Display Terms Shortcode Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Display Terms Shortcode Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51610 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 332217e00b2c Credits SOPROBRO Required privilege...

WordPress plugin SIP Reviews Shortcode for WooCommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress WP Simple Anchors Links plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpanchor Shortcode vulnerability discovered by theviper17y in WordPress Plugin WP Simple Anchors Links versions = 1.0.0...

CVE-2024-8444

The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting...

CVE-2024-10108 WPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advertsadd shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2024-10223

CVE-2024-10223 affects the WP Team – WordPress Team Member Plugin up to version 1.1.4. The vulnerability is a Stored Cross-Site Scripting (XSS) via the htteamember shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It requires authenticated access at...

CVE-2024-8444

CVE-2024-8444 concerns the WordPress Download Manager plugin prior to version 3.3.00. The vulnerability arises because certain shortcode parameters aren’t properly sanitized, enabling a cross-site scripting (XSS) issue. Affected product: Download Manager WordPress plugin (versions

CVE-2024-9846

The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-8627

The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...