WordPress Widget Bundle Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Widget Bundle Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4616 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c8a3dbf68bfd Credits Bob Matyas Required...

PT-2024-33642 · WordPress · Widget Bundle

Name of the Vulnerable Software and Affected Versions: Widget Bundle WordPress plugin versions prior to 2.0.1 Description: The issue is related to the lack of CSRF checks when logging widgets. This could allow attackers to make logged-in admins enable or disable widgets via a CSRF attack...

WordPress Widget Bundle Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Widget Bundle Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4969 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4d33e296cc6c Credits Bob Matyas Required...

WordPress plugin Widget Bundle security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exis...

CVE-2024-4969: Cross-Site Request Forgery (CSRF)

The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged in admin enable/disable widgets via a CSRF attack...

WordPress plugin Widget Bundle security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security...

WordPress Widget Bundle Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Widget Bundle Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4970 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 514fc978f80d Credits Bob Matyas Required privileg...

CVE-2024-4970: Improper Neutralization of Input During Web Page Generation

The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4616: Improper Neutralization of Input During Web Page Generation

The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

CVE-2024-5686

The WPZOOM Addons for Elementor Templates, Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-5686

The WPZOOM Addons for Elementor Templates, Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-5686

CVE-2024-5686 affects the WordPress plugin “WPZOOM Addons for Elementor (Templates, Widgets)”. The vulnerability is a Stored Cross-Site Scripting in the Team Members widget via the url attribute, present in all versions up to 1.1.38. The root cause is insufficient input sanitization and output es...

PT-2024-35741 · WordPress · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder plugin for WordPress versions up to, and including, 5.5.6 Description: The issue is related to Reflected Cross-Site Scripting via the forgoturl attribute within the plugin's WP Login & Register widge...

PT-2024-37082 · Wpzoom · Wpzoom Addons For Elementor

Name of the Vulnerable Software and Affected Versions: WPZOOM Addons for Elementor plugin versions up to, and including, 1.1.38 Description: The issue is related to Stored Cross-Site Scripting via the url attribute within the plugin's Team Members widget due to insufficient input sanitization and...

CVE-2024-5686: Improper Neutralization of Input During Web Page Generation

The WPZOOM Addons for Elementor Templates, Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-4663

The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-4663

The CVE-2024-4663 entry covers the OSM Map Widget for Elementor WordPress plugin. It affects all versions up to 1.2.2, with a Reflected Cross-Site Scripting vulnerability in the id parameter caused by insufficient input sanitization and output escaping. The issue can allow unauthenticated attacke...

CVE-2024-4663 OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-4663 OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress plugin OSM Map Widget for Elementor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerabilit...