CVE-2024-9452

The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inje...

PT-2024-39744 · WordPress · Mynx Page Builder

Name of the Vulnerable Software and Affected Versions: Mynx Page Builder plugin for WordPress versions up to, and including, 0.27.8 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

UBUNTU-CVE-2024-43362

Cacti is an open source performance and fault management framework. The fileurl parameter is not properly sanitized when saving external links in links.php . Morever, the said fileurl is placed in some html code which is passed to the print function in link.php and index.php, finally leading to...

CVE-2024-44041

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Martin Gibson IdeaPush allows Stored XSS.This issue affects IdeaPush: from n/a through 8.66...

PT-2024-32697 · Vdocipher · Vdocipher

Name of the Vulnerable Software and Affected Versions: VdoCipher versions 1.29 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting XSS. This allows for Stored XSS. Recommendations: For VdoCipher versions...

WordPress plugin Ultimate Member 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

WordPress AVIF & SVG Uploader plugin <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin AVIF & SVG Uploader versions = 1.1.0...

PLANET switch devices 跨站脚本漏洞

PLANET switch devices are a series of switch devices from the Chinese company PLANET. A cross-site scripting vulnerability exists in PLANET switch devices, which stems from improper validation of web application parameters and is susceptible to stored cross-site scripting attacks...

WordPress OSM plugin <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via osmmap and osmmapv3 Shortcodes vulnerability discovered by Peter Thaleikis in WordPress Plugin OSM versions = 6.1.0...

Ampache 跨站脚本漏洞

Ampache is an open source web-based audio/video application and file manager from Ampache. A cross-site scripting vulnerability exists in Ampache versions prior to 6.6.0 that stems from vulnerability to stored cross-site scripting attacks...

Projectworlds Online Voting System 安全漏洞

Projectworlds Online Voting System is an online voting system from Projectworlds India. A security vulnerability exists in Projectworlds Online Voting System version 1.0, which stems from the vulnerability to stored cross-site scripting attacks when registering an account using a malicious...

WordPress Themesflat Addons For Elementor plugin <= 2.2.1 - Multiple Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Multiple Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin themesflat-addons-for-elementor versions = 2.2.1...

PT-2024-39404 · WordPress · Graphicsly

Name of the Vulnerable Software and Affected Versions: The Graphicsly plugin for WordPress versions up to, and including, 1.0.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticat...

WordPress NiceJob plugin < 3.6.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin NiceJob versions 3.6.5...

CVE-2024-8092

The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8742

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitizatio...

CVE-2024-6017

The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8440

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output...

PT-2024-37320 · WordPress · Music Request Manager

Name of the Vulnerable Software and Affected Versions: Music Request Manager WordPress plugin versions 1.3 and earlier Description: The issue is related to the lack of CSRF check in some places, as well as missing sanitisation and escaping in the Music Request Manager WordPress plugin. This could...

CVE-2024-6889

The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...