CVE-2024-5289

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2024-5289

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2024-5289 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possibl...

WordPress Plugin kadence-blocks Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-37247

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in twinpictures, baden03 jQuery T- Countdown Widget allows Stored XSS.This issue affects jQuery T- Countdown Widget: from n/a through 2.3.25...

CVE-2024-37247

CVE-2024-37247 refers to a stored XSS in the WordPress plugin jQuery T(-) Countdown Widget (versions &lt;= 2.3.25). The root cause is improper input neutralization during page generation in the plugin, enabling cross-site scripting when processing user-supplied data. Affected product: WordPress p...

WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.2.42 - Contributor+ Stored Cross-Site Scripting in Google Maps Widget vulnerability

Contributor+ Stored Cross-Site Scripting in Google Maps Widget vulnerability discovered by wesley wcraft in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.42...

WordPress Video Widget plugin <= 1.2.3 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Bob Matyas in WordPress Plugin Video Widget versions = 1.2.3...

CVE-2024-5215

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Exclusive Addons for Elementor plugin <= 2.6.9.8 - Contributor+ Stored Cross-Site Scripting via Card Widget vulnerability

Contributor+ Stored Cross-Site Scripting via Card Widget vulnerability discovered by wesley wcraft in WordPress Plugin Exclusive Addons Elementor versions = 2.6.9.8...

CVE-2024-5169

The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5332

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5332

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5169

The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5169 Video Widget <= 1.2.3 - Admin+ Stored XSS via Widget

The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5169

CVE-2024-5169 affects the Video Widget WordPress plugin (versions ≤ 1.2.3). The vulnerability arises from insufficient sanitisation/escaping of widget settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Public‑facing advi...

CVE-2024-5173

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-5173

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-5173

The HT Mega – Absolute Addons For Elementor WordPress plugin (versions ≤ 2.5.5) is vulnerable to stored XSS via the Video Player widget settings due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contributor level or higher, enabling injectio...

WordPress Video Widget Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Video Widget Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5169 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 23642e80fedc Credits Bob Matyas Required privilege...