PT-2024-25450 · Unknown · Meks Themeforest Smart Widget

Name of the Vulnerable Software and Affected Versions: Meks ThemeForest Smart Widget versions through 1.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker ca...

WordPress plugin Meks ThemeForest Smart Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin Me...

PT-2024-25449 · Unknown · Meks Smart Social Widget

Name of the Vulnerable Software and Affected Versions: Meks Smart Social Widget versions 1.6.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

WordPress plugin Meks Smart Social Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress Meks Smart Social Widget Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Meks Smart Social Widget Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33693 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 92d549959266 Credits Joshua Chan Required privileg...

WordPress Smart Recent Posts Widget Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Smart Recent Posts Widget Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33692 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 734e2b75e9d6 Credits Joshua Chan Required privilege...

WordPress WordPress Ad Widget Plugin <= 2.20.0 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Ad Widget Type Plugin Vulnerable versions = 2.20.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33696 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b3b1c1f912e9 Credits Joshua Chan Required privilege...

WordPress Ultimate Posts Widget Plugin <= 2.2.9 is vulnerable to Broken Access Control

Software Ultimate Posts Widget Type Plugin Vulnerable versions = 2.2.9 Fixed in 2.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 565122e43072 Credits Dhabaleshwar Das Requir...

WordPress plugin Fan Page Widget by ThemeNcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin Fan Pag...

WordPress WP Page Post Widget Clone plugin <= 1.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Do Minh Long Patchstack Alliance in WordPress Plugin WP Page Post Widget Clone versions = 1.0.1...

CVE-2024-3988

The Sina Extension for Elementor Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Fancy Text Widget in all versions up to, and including, 3.5.2 due to...

CVE-2024-3988

The Sina Extension for Elementor (WordPress plugin) is vulnerable under CVE-2024-3988 to Stored Cross-Site Scripting via the Sina Fancy Text Widget in versions up to 3.5.2. Exploitation requires authenticated access at contributor level+, and scripts can execute when users load injected pages. Th...

CVE-2024-3929

Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) for WordPress is vulnerable to Stored XSS via the Widget Post Overlay block in all versions up to and including 3.7.0. An authenticated attacker with contributor-level access can inject scrip...

CVE-2024-3929 Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay

The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More Gutenberg Blocks and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Widget Post Overlay block in all versions up to, and including, 3.7.0 due to insufficient input sanitization and...

CVE-2024-3929 Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay

The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More Gutenberg Blocks and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Widget Post Overlay block in all versions up to, and including, 3.7.0 due to insufficient input sanitization and...

WordPress Content Views plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Widget Post Overlay vulnerability discovered by wesley wcraft in WordPress Plugin Content Views versions = 3.7.0...

WordPress Sina Extension for Elementor plugin <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Sina Fancy Text Widget vulnerability discovered by wesley wcraft in WordPress Plugin Sina Extension for Elementor versions = 3.5.2...

PT-2024-28422 · WordPress · Content Views – Post Grid & Filter

Name of the Vulnerable Software and Affected Versions: The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More plugin for WordPress versions up to, and including, 3.7.0 Description: The issue is related to Stored Cross-Site Scripting via the Widget Post Overlay block due to...

WordPress WP Page Post Widget Clone Plugin <= 1.0.1 is vulnerable to Broken Access Control

Software WP Page Post Widget Clone Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33636 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bc529e210eb8 Credits Do Minh Long Required...

The Plus Addons for Elementor < 5.5.0 - Contributor+ Stored Cross-Site Scripting via Countdown Widget

Description The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...