CVE-2024-4268

CVE-2024-4268 – Ultimate Blocks (WordPress Blocks Plugin) vulnerable to a Stored XSS in all versions up to 3.1.9 due to insufficient input sanitization and output escaping on user-supplied attributes. Requires authenticated access (Contributor+) to inject scripts that run when users load injected...

CVE-2024-5544 Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-5544 Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-5544

CVE-2024-5544 affects the WordPress plugin Media Library Assistant. The vulnerability is a Reflected Cross-Site Scripting flaw in the order parameter present in all versions up to and including 3.17, caused by insufficient input sanitization and output escaping. The issue enables unauthenticated ...

CVE-2024-1427 The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag

The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the section title tag attribute in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping on user...

CVE-2023-4017

The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2023-4017

CVE-2023-4017 (Goya Theme for WordPress) : Reflected XSS via parameters attra-color, attra-size, and product-cata in versions up to 1.0.8.7 due to insufficient input sanitization and output escaping. Exploitation by unauthenticated attackers could inject script in pages executed when a user click...

CVE-2023-4017 Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters

The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2024-5889 Events Manager <= 6.4.8 - Reflected Cross-Site Scripting

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-6405

The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the floatingsocialbuttonsoption function. This makes it possible for unauthenticated attackers to update...

CVE-2024-6405 Floating Social Buttons <= 1.5 - Cross-Site Request Forgery

The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the floatingsocialbuttonsoption function. This makes it possible for unauthenticated attackers to update...

CVE-2024-6405 Floating Social Buttons <= 1.5 - Cross-Site Request Forgery

The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the floatingsocialbuttonsoption function. This makes it possible for unauthenticated attackers to update...

CVE-2024-6405

CVE-2024-6405 affects the WordPress plugin Floating Social Buttons . The vulnerability is a Cross-Site Forgery (CSRF) in versions up to 1.5 due to missing/incorrect nonce validation in the function floating_social_buttons_option() . This enables unauthenticated attackers to update the plugin’s se...

CVE-2024-5788

The Silesia theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute within the theme's Button shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-6288 Conversios.io - All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 7.1.0 - Reflected Cross-Site Scripting

The Conversios – Google Analytics 4 GA4, Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tiktokuserid’ parameter in all versions up to, and including, 7.1.0 due to insufficient input sanitization and output...

CVE-2024-5788 Silesia <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

The Silesia theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute within the theme's Button shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2024-6288: Improper Neutralization of Input During Web Page Generation

The Conversios – Google Analytics 4 GA4, Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tiktokuserid’ parameter in all versions up to, and including, 7.1.0 due to insufficient input sanitization and output...

PT-2024-37519

Name of the Vulnerable Software and Affected Versions: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress versions up to and including 3.13.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically v...

CVE-2024-4569

CVE-2024-4569 affects Elementor Addon Elements for WordPress (≤1.13.5). It is a Stored XSS via the url parameter due to insufficient input sanitization and output escaping. Exploitation requires at least contributor+ privileges (authenticated). Wordfence lists this CVE as patched for the plugin, ...

PT-2024-33698

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor versions up to, and including, 5.6.0 Description: The issue is related to Stored Cross-Site Scripting via the video color parameter due to insufficient input sanitization and output escaping. This allows...