CVE-2024-0974 Social Media Widget < 4.0.9 - Admin+ Stored XSS

The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-0974

CVE-2024-0974 affects the Social Media Widget WordPress plugin prior to 4.0.9. The issue is Stored XSS caused by insufficient sanitization/escaping of settings, enabling high-privilege users (e.g., admins) to inject scripts, even when unfiltered_html is disallowed (e.g., multisite). Remediation: ...

PT-2024-37669 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.36 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Animated Text widget. This allo...

WordPress plugin Premium Addons for Elementor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in th...

WordPress plugin Social Media Widget security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2024-15953 · WordPress · Social Media Widget

Name of the Vulnerable Software and Affected Versions: Social Media Widget WordPress plugin versions prior to 4.0.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for examp...

WordPress Social Media Widget Plugin < 4.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Social Media Widget Type Plugin Vulnerable versions 4.0.9 Fixed in 4.0.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0974 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 904528994de0 Credits Dmitrii Ignatyev...

WordPress Meks Smart Author Widget plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Meks Smart Author Widget versions = 1.1.4...

CVE-2024-4866

The UltraAddons – Elementor Addons Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.1.6 due to insufficient input...

WordPress Meks Smart Author Widget Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)

Software Meks Smart Author Widget Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37958 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 05e653299b5f Credits Joshua Chan Required privileg...

PT-2024-33179 · WordPress · Ultraaddons

Name of the Vulnerable Software and Affected Versions: UltraAddons – Elementor Addons plugin for WordPress versions up to, and including, 1.1.6 Description: The issue is related to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and output escaping on...

WordPress Extensions for Elementor plugin <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via EE Events and EE Flipbox Widget vulnerability discovered by stealthcopter in WordPress Plugin Extensions for Elementor versions = 2.0.32...

WordPress plugin Extensions for Elementor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

CVE-2024-37553

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4...

CVE-2024-37553

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4...

CVE-2024-37553 WordPress Testimonials Widget plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4...

CVE-2024-37553 WordPress Testimonials Widget plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4...

CVE-2024-37553

CVE-2024-37553 : Affects WordPress plugin Testimonials Widget (vulnerable: up to 4.0.4). Root cause: Improper Neutralization of Input During Web Page Generation, enabling Stored XSS. Exploitation status (per connected data): Unpatched. Public references indicate PatchStack discussion; CVSS bases ...

WordPress Testimonials Widget plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Testimonials Widget versions = 4.0.4...

WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Meks Easy Ads Widget versions = 2.0.8...