PT-2024-17289 · WordPress · Tithe.Ly Giving Button

Name of the Vulnerable Software and Affected Versions: Tithe.ly Giving Button WordPress plugin versions 1.1 and earlier Description: The issue concerns a Stored Cross-Site Scripting vulnerability. It arises because the plugin does not validate and escape some of its shortcode attributes before...

PT-2024-35723

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.8.2.1 Description The issue is related to missing access checks in the REST API, allowing unauthenticated users to access information about password-protected events. Recommendations For...

CVE-2024-11721

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated...

CVE-2024-11712

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById function in all versions up to, and including, 2.2.2. This makes it possible for...

CVE-2024-11711 WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'resumeid' parameter in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-12446

CVE-2024-12446 is a stored cross-site scripting vulnerability in the WordPress Post to Pdf plugin (all versions up to 1.0) exploitable by authenticated users with contributor+ privileges via the gmptp_single_post shortcode. The issue arises from insufficient input sanitization and output escaping...

CVE-2024-12474

The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-12459 Ganohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and including, 0.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12458

The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11883

The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnxscriptcode' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11884

CVE-2024-11884 affects the WordPress plugin WP Photo Text Slider 50 (wp-photo-text-slider-50). The vulnerability is a Stored XSS via the plugin’s shortcode wp-photo-slider, caused by insufficient input sanitization and output escaping of user-supplied attributes. Impact: authenticated attackers w...

CVE-2024-12523

CVE-2024-12523 affects the States Map US WordPress plugin, allowing Stored Cross-Site Scripting via the states_map shortcode in all versions up to 2.4.2. Exploitation requires authenticated access (contributor+) and can inject scripts that run when users visit the page. The provided sources inclu...

CVE-2024-12447

CVE-2024-12447 is a vulnerability in the Get Post Content Shortcode plugin for WordPress, affecting all versions up to 0.4. It enables Insecure Direct Object Reference via the post_content shortcode due to missing validation on a user-controlled key, allowing authenticated attackers with Contribu...

CVE-2024-12447 Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode

The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-content' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2024-11770

CVE-2024-11770 refers to a Stored Cross-Site Scripting vulnerability in the Post Carousel & Slider WordPress plugin. Affected: Post Carousel & Slider (WordPress plugin) up to version 1.0.4. Root cause: insufficient input sanitization and output escaping on user-supplied attributes in the post-cs ...

CVE-2024-11879

CVE-2024-11879 is rejected and not used; reference CVE-2024-53752 instead.

CVE-2024-11867

CVE-2024-11867 affects the Companion Portfolio – Responsive Portfolio Plugin for WordPress. The issue is Stored Cross-Site Scripting via the plugin’s companion-portfolio shortcode in all versions up to and including 2.4.0.1, caused by insufficient input sanitization and output escaping on user-su...

CVE-2024-11889

CVE-2024-11889 concerns a Stored XSS in the WordPress plugin “My IDX Home Search.” According to the CVE description, the vulnerability exists in the plugin’s shortcodes, specifically the ‘homeasap-idx-search’ shortcode, allowing an authenticated attacker with contributor-level access or higher to...

CVE-2024-54340 WordPress Simple Presenter plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sylvia van Os Simple Presenter allows Reflected XSS.This issue affects Simple Presenter: from n/a through 1.5.1...

CVE-2024-54310 WordPress Gou Manage My Account Menu plugin <= 1.0.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Aslam Khan Gouran Gou Manage My Account Menu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Gou Manage My Account Menu: from n/a through 1.0.1.8...