WordPress Cryptocurrency Widgets For Elementor plugin <= 1.6.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Zaidan Rizaki Patchstack Alliance in WordPress Plugin Cryptocurrency Widgets For Elementor versions = 1.6.4...

CVE-2024-11365

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...

CVE-2024-11365

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...

CVE-2024-10316 Stratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/templates/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...

CVE-2024-10316

CVE-2024-10316 involves the Stratum – Elementor Widgets WordPress plugin. The vulnerability affects all versions up to and including 1.4.4 and resides in includes/templates/content-switcher.php, enabling authenticated attackers with Contributor+ privileges to exfiltrate sensitive template data (p...

CVE-2024-10316 Stratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/templates/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...

CVE-2024-11365

CVE-2024-11365 affects the WordPress plugin Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes . The vulnerability is a Reflected Cross-Site Scripting (XSS) due to unsafe use of the URL-building function add_query_arg without proper escaping, in versions up to and including 1.1.6. This enab...

CVE-2024-11365 Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...

CVE-2024-9542: Exposure of Sensitive Information to an Unauthorized Actor

The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render function in modules/content-switcher/widgets/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-leve...

CVE-2024-11365: Improper Neutralization of Input During Web Page Generation

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...

CVE-2024-10316: Exposure of Sensitive Information to an Unauthorized Actor

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/templates/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract...

PT-2024-16183

Name of the Vulnerable Software and Affected Versions The Stratum – Elementor Widgets plugin for WordPress versions up to, and including, 1.4.4 Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template da...

WordPress Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin <= 1.1.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Crypto and DeFi Widgets versions = 1.1.6...

CVE-2024-10365 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tpcarouselanything.php,...

WordPress Crypto and DeFi Widgets Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Crypto and DeFi Widgets Type Plugin Vulnerable versions = 1.1.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11365 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5b571d52ad59 Credits vgo0 Requir...

PT-2024-16937 · WordPress · The Crypto/Defi Widgets – Web3 Cryptocurrency Shortcodes

Name of the Vulnerable Software and Affected Versions: The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress versions up to, and including, 1.1.6 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated...

CVE-2024-51669

Cross-Site Request Forgery CSRF vulnerability in Kalmang Dynamic Widgets dynamic-widgets.This issue affects Dynamic Widgets: from n/a through = 1.6.4...

CVE-2024-51669

Cross-Site Request Forgery CSRF vulnerability in Vivwebs Dynamic Widgets.This issue affects Dynamic Widgets: from n/a through 1.6.4...

CVE-2024-51669

CVE-2024-51669: WordPress Dynamic Widgets plugin contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 1.6.4 and earlier. A fix is available in 1.6.5. Patchstack notes an unauthenticated vector and low-priority severity for this entry, while NVD assigns a high base score (8.8) fo...

CVE-2024-51669 WordPress Dynamic Widgets plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Kalmang Dynamic Widgets dynamic-widgets.This issue affects Dynamic Widgets: from n/a through = 1.6.4...