CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4482 – The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
https://notcve.org/view.php?id=CVE-2024-4482
02 Jul 2024 — The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied 'text_days' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access... • https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.5.1/modules/widgets/tp_countdown.php#L1945 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5344 – The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget
https://notcve.org/view.php?id=CVE-2024-5344
20 Jun 2024 — The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the plugin's WP Login & Register widget in all versions up to, and including, 5.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. El complemento T... • https://roadmap.theplusaddons.com/updates • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35709 – WordPress The Plus Addons for Elementor plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-35709
08 Jun 2024 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.5.4. Vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en POSIMYTH The Plus Addons for Elementor Page Builder Lite permiten XSS Almacenado. Este problema afecta a lo... • https://patchstack.com/database/vulnerability/the-plus-addons-for-elementor-page-builder/wordpress-the-plus-addons-for-elementor-plugin-5-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45657 – WordPress Nexter Theme <= 2.0.3 is vulnerable to SQL Injection
https://notcve.org/view.php?id=CVE-2023-45657
12 Oct 2023 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects Nexter: from n/a through 2.0.3. La neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL ('inyección SQL') en POSIMYTH Nexter permite la inyección SQL. Este problema afecta a Nexter: desde n/a hasta 2.0.3. The Nexter theme for WordPress is vulnerable to SQL Injection via the 'to' and 'from' parameters in vers... • https://github.com/RandomRobbieBF/CVE-2023-45657 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45750 – WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-45750
12 Oct 2023 — Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in POSIMYTH Nexter Extension plugin <= 2.0.3 versions. Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada No Autenticada en el complemento POSIMYTH Nexter Extension en versiones <= 2.0.3. The Nexter Extension plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘post’ and 'post_id' parameters in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for u... • https://patchstack.com/database/vulnerability/nexter-extension/wordpress-nexter-extension-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45751 – WordPress Nexter Extension Plugin <= 2.0.3 is vulnerable to Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2023-45751
12 Oct 2023 — Improper Control of Generation of Code ('Code Injection') vulnerability in POSIMYTH Nexter Extension.This issue affects Nexter Extension: from n/a through 2.0.3. Vulnerabilidad de control inadecuado de generación de código ("inyección de código") en POSIMYTH Nexter Extension. Este problema afecta a Nexter Extension: desde n/a hasta 2.0.3. The Nexter Extension plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.3 via the nxt-code-php-snippet metabox. This allows ... • https://patchstack.com/database/vulnerability/nexter-extension/wordpress-nexter-extension-plugin-2-0-3-remote-code-execution-rce-vulnerability?_s_id=cve • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24949 – The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection
https://notcve.org/view.php?id=CVE-2021-24949
13 Dec 2021 — The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection El widget "WP Search Filters" del plugin The Plus Addons for Elementor - Pro de WordPress versiones anteriores a 5.0.7, no sanea y escapa del parámetro option antes de usarlo en una sentencia SQL, lo que podría conllevar a una inyección SQL • https://roadmap.theplusaddons.com/updates • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24948 – The Plus Addons for Elementor Pro < 5.0.7 - Sensitive Data Disclosure
https://notcve.org/view.php?id=CVE-2021-24948
13 Dec 2021 — The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts El plugin Plus Addons for Elementor - Pro de WordPress versiones anteriores a 5.0.7, no comprueba el parámetro qvquery de la acción AJAX tp_get_dl_post_info_ajax, lo que podría permitir a usuarios no autenticados recuperar información confidencial, como ... • https://roadmap.theplusaddons.com/updates • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24359 – The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending
https://notcve.org/view.php?id=CVE-2021-24359
31 May 2021 — The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover. El WordPress Plus Addons para Elementor Page ... • https://theplusaddons.com/changelog • CWE-284: Improper Access Control CWE-287: Improper Authentication CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24358 – The Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
https://notcve.org/view.php?id=CVE-2021-24358
31 May 2021 — The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue. El Plus Addons para Elementor Page Builder WordPress, versiones anteriores a 4.1.10, no comprobaba un parámetro redirect en una URL específicamente diseñada antes de redireccionar al usuario a ella, conllevando a un problema de Redireccionamiento Abierto • https://theplusaddons.com/changelog • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •