CVE-2023-6993

The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping on user supplied post meta values...

CVE-2024-1794 Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file e.g. 3gpp file in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-1794

CVE-2024-1794 is a stored XSS flaw in WordPress Forminator up to version 1.29.0 via file uploads (e.g., 3gpp). Public docs confirm unauthenticated exploitation leading to script execution when served pages load injected content. Connected sources indicate the issue was addressed in later patches ...

CVE-2024-3512

CVE-2024-3512 is a duplicate of CVE-2024-2583. The underlying issue affects WordPress Shortcodes Plugin Shortcodes Ultimate prior to version 7.0.5, where shortcodes attributes were not properly escaped, enabling Stored XSS by users with the Contributor role. Remediation is to upgrade to version 7...

CVE-2024-3064 Elementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heading' widgets in all versions up to, and including, 1.4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-0376

CVE-2024-0376 affects the Premium Addons for Elementor plugin on WordPress. It enables Stored Cross-Site Scripting via the Wrapper Link Widget in all versions up to 4.10.16 due to insufficient input sanitization and output escaping of user‑provided URLs. Exploitation requires at least Contributor...

CVE-2024-1774 Customily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site Scripting

The Customily Product Personalizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user cookies in all versions up to, and including, 1.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2024-1774

CVE-2024-1774 affects the Customily Product Personalizer WordPress plugin. It is an unauthenticated Stored Cross-Site Scripting via user cookies in all versions up to 1.23.3 due to insufficient input sanitization and output escaping, enabling arbitrary scripts to run when users visit injected pag...

CVE-2024-1852 WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

BizCalendar Web <= 1.1.0.19 - Reflected Cross-Site Scripting via 'tab'

Description The BizCalendar Web plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.1.0.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Element Pack Elementor Addons < 5.5.4 - Contributor+ Stored XSS via Trailer Box Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the ‘elementpackwrapperlink’ attribute of the Trailer Box widget due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inje...

xss_home_page_wondercms_3.4.3

XSS in WonderCMS 3.4.3 HOME PAGE Software link: WonderCM...

CVE-2024-2458

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-2458

CVE-2024-2458 affects the Powerkit – Supercharge your WordPress Site plugin for WordPress. It is a Stored XSS via shortcode attributes, present in all versions up to and including 2.9.1 due to insufficient input sanitization and output escaping. Exploitation requires authentication at contributor...

CVE-2024-0837

Technical details beyond the initial description are not provided in the attached documents. Monitor for updates to confirm affected versions, impact, and fixes.

CVE-2024-2471

The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type' in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This...

CVE-2024-2656

CVE-2024-2656: Icegram Express Email Subscribers for WordPress contains Stored XSS via CSV import in all versions up to 5.7.14. Exploitation requires authenticated admin-level access (plus). Affected on multi-site installations and where unfiltered_html is disabled; root cause is insufficient inp...

CVE-2024-2868

CVE-2024-2868 affects the ShopLentor (WooCommerce Builder) WordPress plugin. The vulnerability is stored XSS via the slitems parameter in the WL Special Day Offer Widget, present in all versions up to 2.8.3 due to insufficient input sanitization and output escaping. Exploitation requires authenti...

Woocommerce Social Media Share Buttons <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting

Description The Woocommerce Social Media Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to...

Critical Security Flaw Found in Popular LayerSlider WordPress Plugin

A critical security flaw impacting the LayerSlider plugin for WordPress could be abused to extract sensitive information from databases, such as password hashes. The flaw, designated as CVE-2024-2879, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of SQL...