CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2185 – Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget
https://notcve.org/view.php?id=CVE-2024-2185
13 Mar 2024 — The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Beaver Builder Addons de WPZOOM para WordPress es vulnerable a Cross-Si... • https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2181 – Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
https://notcve.org/view.php?id=CVE-2024-2181
13 Mar 2024 — The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Beaver Builder Addons de WPZOOM para WordPress es vulnerable a Cross-Site ... • https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2187 – Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget
https://notcve.org/view.php?id=CVE-2024-2187
13 Mar 2024 — The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Beaver Builder Addons de WPZOOM para WordPress es vulnerable a Cross... • https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2183 – Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget
https://notcve.org/view.php?id=CVE-2024-2183
13 Mar 2024 — The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-30424 is likely a duplicate of this issue. El complemento Beaver Builder Addons... • https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2186 – Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget
https://notcve.org/view.php?id=CVE-2024-2186
13 Mar 2024 — The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Members widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Beaver Builder Addons de WPZOOM para WordPress es vulnerable a Cross... • https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22162 – WordPress WPZOOM Shortcodes Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2024-22162
16 Jan 2024 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Shortcodes allows Reflected XSS.This issue affects WPZOOM Shortcodes: from n/a through 1.0.1. La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('cross-site Scripting') en WPZOOM Shortcodes permite XSS reflejado. Este problema afecta a WPZOOM Shortcodes: desde n/a hasta 1.0.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... • https://patchstack.com/database/vulnerability/wpzoom-shortcodes/wordpress-wpzoom-shortcodes-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4763 – Icon Widget < 1.3.0 - Contributor+ Stored XSS via Shortcode
https://notcve.org/view.php?id=CVE-2022-4763
03 Jan 2023 — The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. The Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.2.6 due to insufficient input sanitization and ... • https://wpscan.com/vulnerability/2f79a87f-c994-4a1e-b455-39d7d3c5c1b5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4789 – WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode
https://notcve.org/view.php?id=CVE-2022-4789
28 Dec 2022 — The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. El complemento WPZOOM Portfolio WordPress anterior a 1.2.2 no valida ni escapa uno de sus atributos de código corto, lo que podría permitir a los usuarios con un rol tan bajo como colaborador realizar un ataque de cross-site scripting almacenado. The WPZOOM Portfolio plugin for WordPress is vu... • https://wpscan.com/vulnerability/5e816e9a-84e5-42d2-a7ff-e46be9072278 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2391 – Inspiro Pro < 7.2.3 - Contributor+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-2391
18 Jul 2022 — The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description. El plugin Inspiro PRO de WordPress no sanea la descripción del slider del portafolio, permitiendo a usuarios con privilegios tan bajos como Contributor inyectar JavaScript en la descripción The Inspiro Pro theme for WordPress is vulnerable to Stored Cross-Site Scripting via the description area in versions up to, and including, 7... • https://wpscan.com/vulnerability/dd6ebf6b-209b-437c-9fe4-527ab9e3b9e3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24632 – Recipe Card Blocks < 2.8.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24632
24 Aug 2021 — The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue El plugin Recipe Card Blocks by WPZOOM de WordPress versiones anteriores a 2.8.1 no escapa el parámetro message antes de devolverlo al panel de administración, conllevando a un problema de tipo Cross-Site Scripting Reflejado The Recipe Card Blocks by WPZOOM plugin for WordPress is vulnerable to Reflected Cross... • https://wpscan.com/vulnerability/55cd6d5e-92c1-407a-8c0f-f89d415ebb66 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •