7135 matches found
PT-2024-20488 · WordPress · Embedpress
Name of the Vulnerable Software and Affected Versions: EmbedPress plugin for WordPress versions up to, and including, 3.9.12 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the EmbedPress...
PT-2024-16312 · WordPress · The Page Builder Gutenberg Blocks – Coblocks
Name of the Vulnerable Software and Affected Versions: The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress versions up to, and including, 3.1.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Icon Widget due to insufficient input sanitization and...
PT-2024-21437 · WordPress · Premium Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.24 Description: The issue is related to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Widget due to insufficient input sanitization and...
PT-2024-19158 · Siteorigin · The Page Builder By Siteorigin
Name of the Vulnerable Software and Affected Versions: The Page Builder by SiteOrigin plugin for WordPress versions up to, and including, 2.29.6 Description: The issue is related to Stored Cross-Site Scripting via the legacy Image widget due to insufficient input sanitization and output escaping...
WordPress Plugin Blocksy Companion 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...
PT-2024-18853 · WordPress · Move Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Move Addons for Elementor plugin for WordPress versions up to, and including, 1.2.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's infobox and button widget due to insufficient input sanitization and output...
PT-2024-20176 · WordPress · Blocksy Companion
Name of the Vulnerable Software and Affected Versions: Blocksy Companion plugin for WordPress versions up to, and including, 2.0.31 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Newsletter widget due to insufficient input sanitization and output escaping on...
CVE-2024-2129
The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...
CVE-2024-1401
The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...
CVE-2024-1401
CVE-2024-1401 affects Profile Box Shortcode And Widget for WordPress, prior to version 1.2.1. Root cause: settings are not sanitized/escaped, enabling Stored XSS for admin-level users (and higher) even when unfiltered_html is disallowed (e.g., multisite). Impact: Stored XSS could compromise site ...
PT-2024-18845 · WordPress · Weglot
Name of the Vulnerable Software and Affected Versions: Translate WordPress and go Multilingual – Weglot plugin for WordPress versions up to, and including, 4.2.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's widget/block due to insufficient input sanitization a...
WordPress Plugin Profile Box Shortcode And Widget Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress Widget for Social Page Feeds Plugin < 6.4 is vulnerable to Cross Site Scripting (XSS)
Software Widget for Social Page Feeds Type Plugin Vulnerable versions 6.4 Fixed in 6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0973 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 4afed9c5ac4e Credits Dmitrii Ignatyev...
WordPress Advanced Social Feeds Widget & Shortcode Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)
Software Advanced Social Feeds Widget & Shortcode Type Plugin Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0951 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 185d76acedb2 Credits...
Translate WordPress and go Multilingual – Weglot < 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
Description The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such ...
Gum Elementor Addon < 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget
Description The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-0951
The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...
CVE-2024-0711
The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...
CVE-2024-0711
The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...