CVE-2024-10637

The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

PT-2024-17238 · WordPress · Currency Converter Widget ⚡ Pro

Name of the Vulnerable Software and Affected Versions: Currency Converter Widget ⚡ PRO plugin for WordPress versions up to, and including, 1.0.6 Description: The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping on user-suppli...

PT-2024-17235 · WordPress · Wp Geonames

Name of the Vulnerable Software and Affected Versions: WP GeoNames plugin for WordPress versions up to, and including, 1.9.0.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wp-geonames' shortcode due to insufficient input sanitization and output escaping on...

WordPress I Plant A Tree plugin <= 1.7.3 - CSRF to Stored Cross-Site Scripting vulnerability

CSRF to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin I Plant A Tree versions = 1.7.3...

WordPress WP System plugin <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin WP System versions = 1.1.1...

WordPress Posti Shipping plugin <= 3.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via generate_notices_html Function vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting via generatenoticeshtml Function vulnerability discovered by vgo0 in WordPress Plugin Posti Shipping versions = 3.10.3...

PT-2024-35822 · Unknown · Simple Travel Map

Name of the Vulnerable Software and Affected Versions: Simple Travel Map versions n/a through 0.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2024-35876 · Unknown · Mins To Read

Name of the Vulnerable Software and Affected Versions: Mins To Read versions 1.2.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2024-35890 · Unknown · Essential Breadcrumbs

Name of the Vulnerable Software and Affected Versions: Essential Breadcrumbs versions 1.1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Essential Breadcrumbs. This means an attacker can trick a user into performing unintended...

PT-2024-35841 · WordPress · Wp Wox Footer Flyout Widget

Name of the Vulnerable Software and Affected Versions: WP WOX Footer Flyout Widget versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored Cross Site Scripting XSS in the WP WOX Footer Flyout Widget. This means an attacker can perform...

PT-2024-16628 · WordPress · Logo Slider

Name of the Vulnerable Software and Affected Versions: Logo Slider WordPress plugin versions prior to 4.5.0 Description: The issue concerns the Logo Slider WordPress plugin, where versions before 4.5.0 do not properly sanitize and escape some of its logo and slider settings. This could allow user...

WordPress Everest Forms plugin < 3.0.4.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Everest Forms versions 3.0.4.2...

WordPress Silverlight Video Player plugin <= 1.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Silverlight Video Player versions = 1.0...

WordPress Kevin's plugin <= 2.0.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Kevin's versions = 2.0.0...

CVE-2024-11404

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS. This issue affects django Filer: from 3 before 3.3...

CVE-2024-10872

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template-post-custom-field block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-10515

In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor...

PT-2024-35261 · WordPress · Wp Popup Window Maker

Name of the Vulnerable Software and Affected Versions: WP Popup Window Maker versions n/a through 2.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in WP Popup Window Maker. Recommendations: For versions n/a through 2.0, update to a...

PT-2024-35028 · Unknown · Erik Saulnier News Articles

Name of the Vulnerable Software and Affected Versions: Erik Saulnier News Articles versions 1.0.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

PT-2024-34788 · Unknown · Sam Wilson Addressbook

Name of the Vulnerable Software and Affected Versions: Sam Wilson Addressbook versions 1.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions 1.1.3 and earlier, update to a version that fixes this issue,...