CVE-2024-2328 Real Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting

The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image title and alt text in all versions up to, and including, 4.22.11 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-3725

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Grid widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied...

CVE-2023-6961

The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.5.12 . The root cause is insufficient input sanitization and output escaping of the ‘Referer’ header . This allows unauthenticated attackers to inject arbitrary web script...

CVE-2024-1840 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author

The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Author tag attribute in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or...

CVE-2024-4036

CVE-2024-4036 concerns the Sydney Toolbox plugin for WordPress. It enables Stored Cross-Site Scripting via the style parameter in all versions up to and including 1.30. The vulnerability requires authentication with at least Contributor access and can allow injection of arbitrary scripts that exe...

CVE-2024-3588

CVE-2024-3588: Getwid – Gutenberg Blocks vulnerable to Stored Cross-Site Scripting via the Countdown block in all versions up to 2.0.7 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher; attacker can inject scripts...

CVE-2024-3337 Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibribreadcrumbelement' shortcode in all versions up to, and including, 1.0.272 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-3199

CVE-2024-3199 (The Plus Addons for Elementor) Details: Authenticated attackers (Contributor+ or higher) can exploit a stored XSS via the Countdown widget in The Plus Addons for Elementor, affecting all versions up to 5.4.2 due to insufficient input sanitization and output escaping. Connected sour...

CVE-2024-3715

CVE-2024-3715 relates to the Database for Contact Form 7, WPforms, and Elementor forms plugins on WordPress. It describes a Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts that execute wh...

CVE-2024-4265

The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 2.0.5.9 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-3729 Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'feaencrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can ...

CVE-2024-2084

CVE-2024-2084 affects HT Mega – Absolute Addons For Elementor (WordPress) via the lightbox widget. Connected sources confirm a Stored XSS due to insufficient input sanitization and output escaping for user-supplied attributes in versions up to and including 2.4.6. Impact requires authentication a...

CVE-2024-2084 HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox widget in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-4092

The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmltag’ parameter in all versions up to, and including, 6.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web...

CVE-2024-4092

CVE-2024-4092 affects Slider Revolution (revslider) for WordPress. It is a Stored XSS via the htmltag parameter in all versions up to 6.7.7. Exploitation is possible by authenticated users (administrators; authors if enabled) and can affect pages viewed by other users. The CVE entry is marked as ...

CVE-2024-1386

CVE-2024-1386 impacts the MailerLite – Signup forms (official) WordPress plugin. It enables Stored Cross-Site Scripting via shortcode attributes in versions 1.5.0–1.7.6, allowing authenticated attackers with contributor-level and higher to inject scripts into pages. The provided documents confirm...

CVE-2024-3677

CVE-2024-3677 refers to The Ultimate 410 Gone Status Code plugin for WordPress, vulnerable to Stored XSS via the 410 entries in all versions up to 1.1.4. The issue requires authentication at contributor+ level and can cause arbitrary script execution on pages loaded by users. The vulnerability ha...

CVE-2024-1805 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute

The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or...

CVE-2024-3489

The CVE-2024-3489 entry concerns Exclusive Addons for Elementor (WordPress). It describes a Reflected Cross-Site Scripting vulnerability in the Countdown Expired Title, affecting all versions up to 2.6.9.4. The root cause is insufficient input sanitization and output escaping, enabling unauthenti...

CVE-2024-1993

CVE-2024-1993 affects the WordPress Icon Widget plugin. Versions up to and including 1.3.0 are vulnerable to Stored XSS via shortcode attributes due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher, enabling an attac...