EmbedPress < 3.9.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute

Description The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress widget 'embedpressprotwitchtheme ' attribute in all versions u...

CVE-2024-2392: Improper Neutralization of Input During Web Page Generation

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-19158 · Siteorigin · The Page Builder By Siteorigin

Name of the Vulnerable Software and Affected Versions: The Page Builder by SiteOrigin plugin for WordPress versions up to, and including, 2.29.6 Description: The issue is related to Stored Cross-Site Scripting via the legacy Image widget due to insufficient input sanitization and output escaping...

PT-2024-21437 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.24 Description: The issue is related to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Widget due to insufficient input sanitization and...

WordPress Plugin Blocksy Companion 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

PT-2024-18853 · WordPress · Move Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Move Addons for Elementor plugin for WordPress versions up to, and including, 1.2.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's infobox and button widget due to insufficient input sanitization and output...

PT-2024-20176 · WordPress · Blocksy Companion

Name of the Vulnerable Software and Affected Versions: Blocksy Companion plugin for WordPress versions up to, and including, 2.0.31 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Newsletter widget due to insufficient input sanitization and output escaping on...

CVE-2024-2129

The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

CVE-2024-2129: Improper Neutralization of Input During Web Page Generation

The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-2124: Improper Neutralization of Input During Web Page Generation

The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such as...

CVE-2024-1401

The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-1401

The Profile Box Shortcode And Widget WordPress plugin versions prior to 1.2.1 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of certain plugin settings, which allows high-privilege users, such as administrators, to execute malicio...

WordPress Plugin Profile Box Shortcode And Widget Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-18845 · WordPress · Weglot

Name of the Vulnerable Software and Affected Versions: Translate WordPress and go Multilingual – Weglot plugin for WordPress versions up to, and including, 4.2.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's widget/block due to insufficient input sanitization a...

CVE-2024-1401: Improper Neutralization of Input During Web Page Generation

The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

WordPress Widget for Social Page Feeds Plugin < 6.4 is vulnerable to Cross Site Scripting (XSS)

Software Widget for Social Page Feeds Type Plugin Vulnerable versions 6.4 Fixed in 6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0973 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 4afed9c5ac4e Credits Dmitrii Ignatyev...

Translate WordPress and go Multilingual – Weglot < 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes

Description The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such ...

WordPress Advanced Social Feeds Widget & Shortcode Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Social Feeds Widget & Shortcode Type Plugin Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0951 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 185d76acedb2 Credits...

Gum Elementor Addon < 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget

Description The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-0951

The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...