PT-2024-30890 · Elementor · Medical Addon For Elementor

Name of the Vulnerable Software and Affected Versions: Medical Addon for Elementor versions n/a through 1.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS. Recommendations: For...

PT-2024-32682 · Unknown · Themelooks Enter Addons

Name of the Vulnerable Software and Affected Versions: ThemeLooks Enter Addons versions n/a through 2.1.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

WordPress plugin DethemeKit For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Fish and Ships plugin <= 1.5.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Fish and Ships versions = 1.5.9...

WordPress Popularis Extra plugin <= 1.2.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Popularis Extra versions = 1.2.6...

PT-2024-38738

Name of the Vulnerable Software and Affected Versions: The FileOrganizer – Manage WordPress and Website Files plugin for WordPress versions up to, and including, 1.0.9 Description: The issue is related to arbitrary file uploads due to missing file type validation in the fileorganizer ajax handler...

PT-2024-39220 · Unknown · Bit File Manager

Name of the Vulnerable Software and Affected Versions: The Bit File Manager versions up to, and including, 6.5.7 Description: The issue is due to a lack of proper checks on allowed file types, making it possible for authenticated attackers with Subscriber-level access and above, and granted...

PT-2024-39515 · WordPress · Memberful

Name of the Vulnerable Software and Affected Versions: Memberful – Membership Plugin versions up to, and including, 1.73.7 Description: The issue is a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's...

CVE-2024-9378

The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-9222

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.12.8. This makes ...

WordPress SEOPress plugin <= 8.1.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin SEOPress versions = 8.1.1...

WordPress MC4WP: Mailchimp Top Bar plugin <= 1.6.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin MC4WP: Mailchimp Top Bar versions = 1.6.0...

WordPress WordPress & WooCommerce Affiliate Program plugin <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation vulnerability

Authentication Bypass to Account Takeover and Privilege Escalation vulnerability discovered by Tonn in WordPress Plugin Affiliate Pro - Affiliate Program for WooCommerce & WordPress versions = 8.4.1...

WordPress Echo RSS Feed Post Generator plugin <= 5.4.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Tonn in WordPress Plugin Echo RSS Feed Post Generator Plugin for WordPress versions = 5.4.6...

WordPress Soumettre.fr plugin <= 2.1.3 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Peter Thaleikis in WordPress Plugin Soumettre.fr versions = 2.1.3...

CVE-2024-8107

The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

WordPress Broken Link Checker plugin <= 2.4.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Broken Link Checker versions = 2.4.0...

WordPress Optin Hound plugin <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter vulnerability

Reflected Cross-Site Scripting via addqueryarg Parameter vulnerability discovered by Francesco Carlucci in WordPress Plugin Optin Hound versions = 1.4.3...

WordPress Wechat Social login plugin <= 1.3.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin Wechat Social login versions = 1.3.0...

WordPress SVG Complete plugin <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin SVG Complete versions = 1.0.2...