CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7044 – Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-7044
03 Jan 2024 — The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Essential Addons for Elementor – Best El... • https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Extensions/Wrapper_Link.php#L65 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6986 – EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
https://notcve.org/view.php?id=CVE-2023-6986
02 Jan 2024 — The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed_oembed_html shortcode in all versions up to 3.9.5 (exclusive) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will ... • https://plugins.svn.wordpress.org/embedpress/trunk/EmbedPress/Shortcode.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 2CVE-2023-6623 – Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion
https://notcve.org/view.php?id=CVE-2023-6623
21 Dec 2023 — The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks. El complemento de WordPress Essential Blocks anterior a 4.4.3 no impide que atacantes no autenticados sobrescriban variables locales al representar plantillas a través de la API REST, lo que puede provocar ataques de inclusión de archivos locales. The Essential Blocks – Page Builder Gutenberg... • https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49184 – WordPress Parallax Slider Block Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-49184
29 Nov 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Parallax Slider Block allows Stored XSS.This issue affects Parallax Slider Block: from n/a through 1.2.4. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('Cross-site Scripting') en WPDeveloper Parallax Slider Block permite almacenar XSS. Este problema afecta el Parallax Slider Block: desde n/a hasta 1.2.4. The Parallax Slider Block plugin for Wo... • https://patchstack.com/database/vulnerability/parallax-slider-block/wordpress-parallax-slider-block-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5749 – EmbedPress < 3.9.2 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-5749
17 Nov 2023 — The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin El complemento EmbedPress de WordPress anterior a 3.9.2 no sanitiza ni escapa a la entrada del usuario antes de devolverla a la página, lo que genera Cross-Site Scripting Reflejada que podría usarse contra usuarios con altos privilegios, como el administrador. The EmbedPress – Emb... • https://wpscan.com/vulnerability/3931daac-3899-4169-8625-4c95fd2adafc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5750 – EmbedPress < 3.9.2 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-5750
17 Nov 2023 — The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin El complemento EmbedPress de WordPress anterior a 3.9.2 no sanitiza ni escapa un parámetro antes de devolverlo a la página que contiene un contenido específico, lo que genera un Cross-Site Scripting Reflejado que podría usarse contra usuarios con pri... • https://wpscan.com/vulnerability/cf323f72-8374-40fe-9e2e-810e46de1ec8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4386 – Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries
https://notcve.org/view.php?id=CVE-2023-4386
13 Sep 2023 — The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. El complemento Essential ... • https://plugins.trac.wordpress.org/browser/essential-blocks/trunk/includes/API/PostBlock.php?rev=2950425#L30 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-4402 – Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products
https://notcve.org/view.php?id=CVE-2023-4402
13 Sep 2023 — The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_products function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. El complemento Essenti... • https://plugins.trac.wordpress.org/browser/essential-blocks/trunk/includes/API/Product.php?rev=2950425#L49 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51375 – WordPress EmbedPress plugin <= 3.8.3 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-51375
07 Sep 2023 — Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.8.3. Vulnerabilidad de autorización faltante en WPDeveloper EmbedPress. Este problema afecta a EmbedPress: desde n/a hasta 3.8.3. The EmbedPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8.3. This is due to missing nonce validation on the clicked() function. • https://patchstack.com/database/vulnerability/embedpress/wordpress-embedpress-plugin-3-8-3-broken-access-control-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4282 – EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data
https://notcve.org/view.php?id=CVE-2023-4282
09 Aug 2023 — The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings. • https://plugins.trac.wordpress.org/browser/embedpress/tags/3.8.2/EmbedPress/ThirdParty/Googlecalendar/Embedpress_Google_Helper.php#L801 • CWE-862: Missing Authorization •