WordPress SW Kick Integration plugin <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via sw-kick-embed Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin SW Kick Integration versions = 1.1.1...

WordPress StreamWeasels YouTube Integration plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via sw-youtube-embed Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin StreamWeasels YouTube Integration versions = 1.3.2...

WordPress affiliate-toolkit plugin <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via atkpproduct Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin affiliate-toolkit versions = 3.6.5...

PT-2024-16126

Name of the Vulnerable Software and Affected Versions affiliate-toolkit plugin for WordPress versions up to, and including, 3.6.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's atkp product shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-10226: Improper Neutralization of Input During Web Page Generation

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Widget or Sidebar Shortcode Plugin <= 0.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Widget or Sidebar Shortcode Type Plugin Vulnerable versions = 0.6.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9885 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 103d39e3e11c Credits theviper17y...

PT-2024-16100 · WordPress · Streamweasels Youtube Integration

Name of the Vulnerable Software and Affected Versions: StreamWeasels YouTube Integration plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode due to insufficient input sanitization an...

PT-2024-16125 · WordPress · Arconix Shortcodes

Name of the Vulnerable Software and Affected Versions: Arconix Shortcodes plugin for WordPress versions up to, and including, 2.1.13 Description: The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode due to insufficient input...

PT-2024-16096 · WordPress · Newsletters

Name of the Vulnerable Software and Affected Versions: Newsletters plugin for WordPress versions up to, and including, 4.9.9.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's newsletters video shortcode due to insufficient input sanitization and output escaping o...

CVE-2024-50440

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Chris Coyier CodePen Embedded Pens Shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through 1.0.2...

CVE-2024-50440 WordPress CodePen Embedded Pens Shortcode plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Coyier CodePen Embedded Pens Shortcode codepen-embedded-pen-shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through = 1.0.2...

CVE-2024-50440

CVE-2024-50440 describes a stored XSS vulnerability in the WordPress plugin CodePen Embedded Pens Shortcode (versions

WordPress plugin CodePen – Embedded Pens Shortcode; Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

CVE-2024-50440: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Coyier CodePen Embedded Pens Shortcode codepen-embedded-pen-shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through = 1.0.2...

PT-2024-34216

Name of the Vulnerable Software and Affected Versions: CodePen Embedded Pens Shortcode versions 1.0.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

CVE-2024-10117

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfdonate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10117 WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfdonate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9772

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-9772

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-9772

CVE-2024-9772 concerns WordPress, specifically the UIX Shortcodes plugin (versions up to 1.9.9; some sources also cite 1.9.7). The vulnerability allows unauthenticated attackers to perform arbitrary shortcode execution by exploiting improper validation when running do_shortcode, via an action exp...