14170 matches found
PT-2025-1612
Name of the Vulnerable Software and Affected Versions The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress versions up to, and including, 1.5.9 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to...
WordPress plugin Borderless has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-10867: Improper Neutralization of Input During Web Page Generation
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible...
WordPress Borderless plugin <= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload vulnerability
Authenticated Author+ Stored Cross-Site Scripting via SVG Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Borderless versions = 1.6.2...
CVE-2024-12163
The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads...
CVE-2024-12163
The goodlayers-core WordPress plugin (versions prior to 2.1.3 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This issue allows users with a subscriber role or higher to upload SVG files containing malicious payloads, which can be executed by other users. To remediate this vulnerabil...
CVE-2024-12163 GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload
The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads...
CVE-2024-12163 GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload
The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads...
CVE-2024-12163: Improper Neutralization of Input During Web Page Generation
The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads...
CVE-2025-23213
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content XSS Payloads. This vulnerability is fixed in 1.5.28...
PT-2025-4852 · Unknown · Tandoor Recipes
Name of the Vulnerable Software and Affected Versions: Tandoor Recipes versions prior to 1.5.28 Description: The issue concerns the file upload feature in Tandoor Recipes, which allows uploading arbitrary files, including html and svg. These files can contain malicious content, such as XSS...
CVE-2025-23213: Unrestricted Upload of File with Dangerous Type
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content XSS Payloads. This vulnerability is fixed in 1.5.28...
Tandoor Recipes: Code Issues and Vulnerabilities
Tandoor Recipes is a Tandoor Recipes open source application for managing recipes, planning meals, creating shopping lists and more. A code issue vulnerability exists in Tandoor Recipes versions prior to 1.5.28, which stems from a file upload feature that allows the upload of arbitrary files,...
CVE-2024-57277
InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting XSS via SVG file upload...
CVE-2024-57277
InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting XSS via SVG file upload...
CVE-2024-57277
InnoShop versions 0.3.8 and below are vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during SVG file uploads . An attacker can upload specially crafted SVG files to inject and execute malicious scripts on the client-side. To mitigate this risk, it is recommended ...
CVE-2024-57277
InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting XSS via SVG file upload...
CVE-2024-57277
InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting XSS via SVG file upload...
