7101 matches found
PT-2024-39911 · WordPress · Widget/Sidebar Shortcode
Name of the Vulnerable Software and Affected Versions: Widget or Sidebar Shortcode plugin for WordPress versions up to and including 0.6.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'sidebar' shortcode, allowi...
PT-2024-39884 · WordPress · Enable Shortcodes Inside Widgets
Name of the Vulnerable Software and Affected Versions: The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress version 1.0.0 and earlier Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a val...
WordPress Widget or Sidebar Shortcode plugin <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by theviper17y in WordPress Plugin Widget or Sidebar Shortcode versions = 0.6.1...
CVE-2024-9505
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
CVE-2024-9505
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
CVE-2024-9505
CVE-2024-9505 affects Beaver Builder – WordPress Page Builder (Plugin). The issue is a stored DOM-based XSS in the Button widget introduced by insufficient input sanitization and output escaping on user-supplied attributes, exploitable by authenticated attackers with contributor-level access and ...
CVE-2024-49660
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Campus Explorer Campus Explorer Widget allows Reflected XSS.This issue affects Campus Explorer Widget: from n/a through 1.4...
CVE-2024-49660 WordPress Campus Explorer Widget plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CampusExplorer Campus Explorer Widget campus-explorer-widget allows Reflected XSS.This issue affects Campus Explorer Widget: from n/a through = 1.4...
CVE-2024-10266
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all versions up to, and including, 4.10.60 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress Beaver Builder plugin <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget vulnerability
Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Button Widget vulnerability discovered by zer0gh0st in WordPress Plugin Beaver Builder versions = 2.8.4.2...
WordPress Premium Addons for Elementor plugin <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget vulnerability
Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via Video Box Widget vulnerability discovered by zer0gh0st in WordPress Plugin Premium Addons for Elementor versions = 4.10.60...
PT-2024-16218 · WordPress · Move Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Move Addons for Elementor plugin for WordPress versions up to, and including, 1.3.5 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data v...
WordPress plugin Campus Explorer Widget 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2024-16146 · Unknown · Premium Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor versions up to and including 4.10.60 Description: The issue is related to Stored Cross-Site Scripting via the Video Box widget due to insufficient input sanitization and output escaping on user-supplied attributes...
PT-2024-33612 · Unknown · Campus Explorer Widget
Name of the Vulnerable Software and Affected Versions: Campus Explorer Widget versions 1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS in the Campus Explorer...
CVE-2024-50575
In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API...
CVE-2024-50575
CVE-2024-50575 affects JetBrains YouTrack prior to version 2024.3.47707, where reflected XSS was possible via the Widget API. The vulnerability is documented across multiple feeds (NVD, Red Hat advisory, CNVD, CNVD, and Nessus plugin) as a cross-site scripting issue in the Widget API in YouTrack’...
CVE-2024-50575
In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API...
