PT-2024-25981 · Unknown · Content Blocks

Name of the Vulnerable Software and Affected Versions: Content Blocks Custom Post Widget versions 3.3.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. There is no...

WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Content Blocks Custom Post Widget versions = 3.3.0...

WordPress Content Blocks (Custom Post Widget) Plugin <= 3.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Content Blocks Custom Post Widget Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34566 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c437cf336c56 Credits Ngô Thiên An ancorn...

TweetScroll Widget <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The TweetScroll Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

Image Hover Effects - Elementor Addon < 1.4.2 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget

Description The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hover Effects Widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-3108

An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device without authorization...

CVE-2024-32831

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lorna Timbah webgrrrl Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2...

CVE-2024-32831 WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lorna Timbah webgrrrl Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2...

CVE-2024-32831 WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lorna Timbah webgrrrl Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2...

CVE-2024-32831

CVE-2024-32831 refers to the WordPress Accessibility Widget plugin (versions n/a through 2.2). The issue is an input handling flaw that allows Stored XSS during web page generation, arising from improper neutralization of input. Affected component is the Accessibility Widget codepath used to rend...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via LaStudioKit Post Author Widget vulnerability discovered by Abu Hurayra in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.3.7.5...

WordPress plugin Accessibility Widget 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-24907 · Unknown · Lorna Timbah (Webgrrrl) Accessibility Widget

Name of the Vulnerable Software and Affected Versions: Lorna Timbah webgrrrl Accessibility Widget versions n/a through 2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

Jeg Elementor Kit < 2.6.5 - Contributor+ Stored XSS via Countdown Widget

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

Motorola Time Weather Widget 安全漏洞

Motorola Time Weather Widget is a mobile weather forecasting application from Motorola, Inc. A security vulnerability exists in Motorola Time Weather Widget, which stems from an implicit intent vulnerability that could allow a local application to gain unauthorized access to the device's location...

PT-2024-23751 · Motorola · Motorola Time Weather Widget

Name of the Vulnerable Software and Affected Versions: Motorola Time Weather Widget affected versions not specified Description: An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device...

CVE-2024-4203

The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions up to, and including, 4.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-4003

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eaelteammembersimagerounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to...

CVE-2024-3891

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in widgets in all versions up to, and including, 3.10.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-3819

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Banner widget in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...