WordPress ElementsKit Pro plugin <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets vulnerability

Authenticated Contributor+ Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets vulnerability discovered by Webbernaut in WordPress Plugin ElementsKit Pro versions = 3.6.0...

WordPress Happy Addons for Elementor plugin <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Calendly Widget vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Happy Addons for Elementor versions = 3.10.6...

WordPress plugin Ad Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

PT-2024-25448 · Unknown · Satrya Smart Recent Posts Widget

Name of the Vulnerable Software and Affected Versions: Satrya Smart Recent Posts Widget versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can...

PT-2024-25451 · Themencode · Fan Page Widget

Name of the Vulnerable Software and Affected Versions: Fan Page Widget by ThemeNcode versions n/a through 2.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

WordPress Fan Page Widget by ThemeNcode Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Fan Page Widget by ThemeNcode Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33695 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 65bb7cdeaec7 Credits Joshua Chan Required privile...

CVE-2024-33693: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Meks Meks Smart Social Widget allows Stored XSS.This issue affects Meks Smart Social Widget: from n/a through 1.6.4...

WordPress Meks ThemeForest Smart Widget Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software Meks ThemeForest Smart Widget Type Plugin Vulnerable versions = 1.5 Fixed in 1.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33694 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 04ccfd2bf640 Credits Joshua Chan Required privile...

WordPress Smart Recent Posts Widget Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Smart Recent Posts Widget Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33692 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 734e2b75e9d6 Credits Joshua Chan Required privilege...

WordPress Meks Smart Social Widget Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Meks Smart Social Widget Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33693 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 92d549959266 Credits Joshua Chan Required privileg...

PT-2024-25449 · Unknown · Meks Smart Social Widget

Name of the Vulnerable Software and Affected Versions: Meks Smart Social Widget versions 1.6.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

WordPress plugin Meks ThemeForest Smart Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin Me...

WordPress Enhanced Text Widget Plugin <= 1.6.4 is vulnerable to Broken Access Control

Software Enhanced Text Widget Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4175d537e956 Credits Dhabaleshwar Das Require...

CVE-2024-33694: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Meks Meks ThemeForest Smart Widget allows Stored XSS.This issue affects Meks ThemeForest Smart Widget: from n/a through 1.5...

CVE-2024-33696: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Broadstreet XPRESS WordPress Ad Widget allows Stored XSS.This issue affects WordPress Ad Widget: from n/a through 2.20.0...

WordPress plugin Meks Smart Social Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-25450 · Unknown · Meks Themeforest Smart Widget

Name of the Vulnerable Software and Affected Versions: Meks ThemeForest Smart Widget versions through 1.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker ca...

CVE-2024-3890: Improper Neutralization of Input During Web Page Generation

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up to, and including, 3.10.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress plugin Fan Page Widget by ThemeNcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin Fan Pag...

WordPress Ultimate Posts Widget Plugin <= 2.2.9 is vulnerable to Broken Access Control

Software Ultimate Posts Widget Type Plugin Vulnerable versions = 2.2.9 Fixed in 2.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 565122e43072 Credits Dhabaleshwar Das Requir...