CVE-2024-3974

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions...

CVE-2024-3680

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's img tag in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-3547

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'googleconnecterror' parameter in all versions up to, and including, 1.5.102 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-34230

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Information parameter...

CVE-2024-34231

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Short Name parameter...

CVE-2024-1166

The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hover Effects Widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

BIT-WORDPRESS-2024-4439

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

BIT-WORDPRESS-MULTISITE-2024-4439

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

Sydney Toolbox < 1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget

Description The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-34230: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Information parameter...

CVE-2024-34231: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Short Name parameter...

CVE-2024-34231

The Sourcecodester Laboratory Management System v1.0 contains a cross-site scripting (XSS) vulnerability. This flaw occurs because the System Short Name parameter does not properly neutralize input, allowing an attacker to execute arbitrary web scripts or HTML via a crafted payload. Practical con...

CVE-2024-34231

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Short Name parameter...

CVE-2024-34230

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Information parameter...

CVE-2024-34230

The Sourcecodester Laboratory Management System v1.0 is vulnerable to a cross-site scripting (XSS) flaw (CWE-79) within the System Information parameter. An attacker can inject a crafted payload to execute arbitrary web scripts or HTML, potentially leading to theft of user data or unauthorized se...

CVE-2024-4490

The CVE-2024-4490 entry concerns the Elegant Themes Divi product family (Divi theme, Divi Extra, Divi Page Builder) with DOM-Based Stored XSS via the title parameter in versions up to and including 4.25.0. The vulnerability arises from insufficient input sanitization and output escaping, enabling...

CVE-2024-4277

CVE-2024-4277 affects LearnPress – WordPress LMS Plugin. Affected: all WordPress versions up to and including 4.2.6.5. Root cause: insufficient input sanitization and output escaping in the layout_html parameter. Impact: authenticated attackers with contributor-level access can store scripts that...

CVE-2024-3547

CVE-2024-3547 affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates) on WordPress. The vulnerability is a Reflected Cross-Site Scripting via the google_connect_error parameter in all versions up to 1.5.102, caused by insufficient input sanitization and output escaping. This al...

CVE-2024-3547 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'googleconnecterror' parameter in all versions up to, and including, 1.5.102 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-4481 Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the plugin's blocks in all versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This...