ByteOS Network

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bdthemes ZoloBlocks allows PHP Local File Inclusion. This issue affects ZoloBlocks: from n/a through 2.3.2.

Vendor-BdThemes

Product-ZoloBlocks

CWE ID-CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-8100

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 7.29%

7 Day CHG~0.00%

Published-06 Aug, 2025 | 03:40

Updated-13 Aug, 2025 | 18:27

Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content

The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Addons for Elementor – Mega Menu, Header Footer, Dynamic Builder and Ready Templates

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-7644

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.04% / 9.65%

7 Day CHG~0.00%

Published-22 Jul, 2025 | 04:25

Updated-22 Jul, 2025 | 16:26

Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-5944

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.06% / 19.02%

7 Day CHG~0.00%

Published-03 Jul, 2025 | 04:25

Updated-09 Jul, 2025 | 17:52

Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons and Templates

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-46258

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 9.87%

7 Day CHG~0.00%

Published-05 Jun, 2025 | 17:36

Updated-05 Jun, 2025 | 20:12

WordPress Element Pack Pro Plugin < 8.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes Element Pack Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Pack Pro: from n/a before 8.0.0.

Vendor-BdThemes

Product-Element Pack Pro

CWE ID-CWE-862

Missing Authorization

CVE-2025-46257

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.02% / 3.41%

7 Day CHG~0.00%

Published-05 Jun, 2025 | 17:35

Updated-05 Jun, 2025 | 20:12

WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.

Vendor-BdThemes

Product-Element Pack Pro

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2025-5292

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.04% / 12.06%

7 Day CHG~0.00%

Published-31 May, 2025 | 06:40

Updated-02 Jun, 2025 | 17:32

Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content’ parameter in all versions up to, and including, 5.11.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-2168

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-4.3||MEDIUM

EPSS-0.02% / 2.45%

7 Day CHG~0.00%

Published-01 May, 2025 | 03:23

Updated-12 May, 2025 | 19:38

Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update

The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Vendor-BdThemes

Product-ultimate_store_kit Ultimate Store Kit – Elementor powered WooCommerce Builder, 80+ Widgets and Template Builder

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2025-1458

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.05% / 15.97%

7 Day CHG+0.01%

Published-26 Apr, 2025 | 05:34

Updated-06 May, 2025 | 14:11

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-1457

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.06% / 18.52%

7 Day CHG~0.00%

Published-19 Apr, 2025 | 03:21

Updated-21 Apr, 2025 | 14:23

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-39588

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-9.8||CRITICAL

EPSS-0.10% / 27.90%

7 Day CHG~0.00%

Published-17 Apr, 2025 | 15:46

Updated-17 Apr, 2025 | 20:21

WordPress Ultimate Store Kit Elementor Addons <= 2.4.0 - Deserialization of untrusted data Vulnerability

Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons allows Object Injection. This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.4.0.

Vendor-BdThemes

Product-Ultimate Store Kit Elementor Addons

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2025-32184

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.06% / 19.97%

7 Day CHG~0.00%

Published-04 Apr, 2025 | 15:58

Updated-07 Apr, 2025 | 14:18

WordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons allows Stored XSS. This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.4.0.

Vendor-BdThemes

Product-Ultimate Store Kit Elementor Addons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-24584

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.42%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 13:59

Updated-27 Jan, 2025 | 14:41

WordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.3.0.

Vendor-BdThemes

Product-Ultimate Store Kit Elementor Addons

CWE ID-CWE-862

Missing Authorization

CVE-2024-12043

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 5.93%

7 Day CHG~0.00%

Published-23 Jan, 2025 | 11:13

Updated-05 Feb, 2025 | 18:52

Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'social_link_title' parameter of the 'blog' widget in all versions up to, and including, 3.16.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-prime_slider Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-12851

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 6.96%

7 Day CHG~0.00%

Published-08 Jan, 2025 | 06:41

Updated-17 Jan, 2025 | 20:47

Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes parameter of the Cookie Consent Widget in all versions up to, and including, 5.10.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-11852

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-4.3||MEDIUM

EPSS-0.08% / 23.97%

7 Day CHG~0.00%

Published-22 Dec, 2024 | 01:41

Updated-29 Jan, 2025 | 15:37

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)

CWE ID-CWE-862

Missing Authorization

CVE-2024-9058

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.04% / 10.59%

7 Day CHG~0.00%

Published-03 Dec, 2024 | 06:50

Updated-29 Jan, 2025 | 15:36

Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lightbox widget in all versions up to, and including, 5.10.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-10980

Assigner-WPScan

View Details

Assigner-WPScan

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 16.87%

7 Day CHG+0.01%

Published-29 Nov, 2024 | 06:00

Updated-07 May, 2025 | 00:03

Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Vendor-Unknown element_pack_elementor_addons_wordpress BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)element_pack_elementor_addons_wordpress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-10493

Assigner-WPScan

View Details

Assigner-WPScan

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 16.87%

7 Day CHG+0.01%

Published-28 Nov, 2024 | 06:00

Updated-15 May, 2025 | 17:37

Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Vendor-Unknown element_pack_elementor_addons_wordpress BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)element_pack_elementor_addons_wordpress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-52377

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-10||CRITICAL

EPSS-0.36% / 57.45%

7 Day CHG~0.00%

Published-14 Nov, 2024 | 17:42

Updated-15 Nov, 2024 | 15:39

WordPress Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI) plugin <= 1.5.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in BdThemes Instant Image Generator allows Upload a Web Shell to a Web Server.This issue affects Instant Image Generator: from n/a through 1.5.4.

Vendor-BdThemes BdThemes

Product-Instant Image Generator instant_image_generator

CWE ID-CWE-434

Unrestricted Upload of File with Dangerous Type

CVE-2024-8442

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.08% / 23.21%

7 Day CHG+0.01%

Published-07 Nov, 2024 | 12:30

Updated-05 Feb, 2025 | 14:52

Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget

The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Blog widget in all versions up to, and including, 3.15.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-prime_slider Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-9867

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-5.4||MEDIUM

EPSS-0.05% / 16.82%

7 Day CHG+0.01%

Published-05 Nov, 2024 | 11:32

Updated-08 Nov, 2024 | 16:00

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+ Stored Cross-Site Scripting via Open Map Widget

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Open Map Widget' marker_content parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-9657

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.5||MEDIUM

EPSS-0.22% / 44.58%

7 Day CHG+0.04%

Published-05 Nov, 2024 | 11:32

Updated-08 Nov, 2024 | 16:00

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip' parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-9868

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-5.4||MEDIUM

EPSS-0.05% / 16.82%

7 Day CHG~0.00%

Published-02 Nov, 2024 | 02:03

Updated-04 Nov, 2024 | 13:44

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate Widget 'url' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-10310

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.05% / 16.82%

7 Day CHG~0.00%

Published-02 Nov, 2024 | 02:03

Updated-04 Nov, 2024 | 13:06

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Gallery Widget 'image_title' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-4974

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.3||MEDIUM

EPSS-0.07% / 22.07%

7 Day CHG~0.00%

Published-16 Oct, 2024 | 06:43

Updated-16 Oct, 2024 | 18:06

Freemius SDK <= 2.4.2 - Missing Authorization Checks

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Vendor-ivan_paulin wpcohort/ninjalibs cleverplugins attest pagup ivacy rafacarvalhido djenh prelc gkher/glowlogix themesty elliotvs pippozanardo ekanath moomooagency whiteshadow ggriesser unitecms carlosmoreirapt closemarketing/annastaa blockypage eedee daigo75 meowcrew codeies ultimateblocks tripetto pluginsware stevejburge vohotv/zeetheme jburleigh1 marcqueralt livemesh tribalnerd elementinvader daniyalahmedk samdani mohammedrezq vinod-dalvi limbcode oceanwp andyabelow tropicalista bilaltas wordplus wpscripts oloyede-jamiu maurolopes/jamesparkninja popeating xplodedthemes tycoon12344 xyulex sebet/mcurly mnelson4 setka skyminds hiddenpearls theafricanboss collizo4sky gowebsmarty anssilaitila wptb nicheaddons anasbinmukim nasirahmed switcorp kkikuchi1220 smusman98 svenl77 halmat closemarketing ethereumicoio 5starplugins protectyouruploads woodyhayday mattpramschufer ivanchernyakov ahmed17 johnc1979 cypressnorth bfintal lkoudal sangaran dangub86 wpvibes fsruslan humblethemes bestpluginswordpress jetixwp 9brada6 cloudliving meeplugins badhonrocks edgegalleryplugin damian-gora shabti patrickgarman paulio21 wphrmanager upfiv wptravelengine co2ok khothemes jurski iksstudio codeatlantic prasadkirpekar wpexpertsio bycrik takanakui mikebels royalnavneet shawoninfo pootlepress codesavory brandonfire passionatebrains svovaf bradvin rafalosinski mikewire_rocksolid wpmagics clickervolt cloudsponge pluginandplay tickera dots jkohlbach codexonics h3technologies chillichalli avidthemes/elbisnero kitthemes powerfulwp matthias-reuter dovyp mvvapps/wpsoul olezhyk5 bplugins mhmrajib kylegilman mbrown24 divisumo risetheme samuelsilvapt javmah pmbaldha milukove/bandido aharonyan sebet wpcohort kartikparmar jack-kitterhing buttonizer richard-b tobias_conrad thijzie stylingwebben lynn999 mte90 danielealessandra tonyzeoli webheadllc kaizencoders sslatlas pmbaldha/webtechstreet sonalsinha21 matstars dejanmarkovic beeneeb melapress vincoit vanyukov arabianmido ronena100 surbma hqtheme jwebsol alphabposervice wpchill davidanderson greenjaymedia kartikparmar/premmerce galoover wgauge kitforest dipcode dotrex rebelcode wppluginexperts ankitmaru webmuehle stevehenty alanfuller wpgeniuz therealwebdisrupt majick actuaryzask wordpresschef blackandwhitedigital paretodigital thinleek cmbibby/cebbi w3scloud milmor pootlepress/oceas frenify themeythemes multicollab kokomoweb imtiazrayhan blockmeister mdedev kenanfallon flexithemes renaudbod wpschoolcalendar scrollsequence interfacelab ldninjas/wisersteps muhammad-rehman modulemasters aguilerasoft wupo foxmoon slidedeck josevega janwyl alleythemes dudo jcodex benmoreassynt wpjoli blockspare themesei drosendo linekal nplugins jwind snazzythemes dreamfox cadudecastroalves cliffpaulick wpconedev smartwpress penguininitiatives starfishwp sindyakinsergei darell plugins360 litonice13 ggedde seancarrico tprintyedisonave salttechno dam6pl syntactics uriahs-victor janthielemann ibenic mantrabrain streamweasels fastaf/tauhidpro intoxstudio wpbits rankbear krsp infornweb dgwyer alexmoss woopops giladtakoni wpeka-club chetmac commercepundit versacomp alex-ye bavokoservices princeahmed theafricanboss/marviorocha deothemes masterblocks pasyuk weconnectcode kartechify ejslondon/mberding boltonstudios maciejbak85 creativethemeshq wpeventpartners/danish-ali lostboy7 seezee mojofywp sslzen tobias_conrad/mihail-barinov invisnet wpdever anfrageformular kaira gallerycreator milukove lukeseager gloriousthemes wpengine spartac irkanu maxsdesign listplus majick/appexpertsio mumarym1985 sj_o xjohnyk essekia smgteam dvizhenia equalizedigital themelocation staxwp sovstack gfirem nitin247 shelob9 atakanoz mohsinoffline boriscolombier/getsparrow cromer12 diviframework toddhalfpenny sakurapixel usmanaliqureshi tranzly maltathemes wpmunich wpdevpowers peterschulznl skshaikat wpt00ls sjaved fullworks ultradevs frostbourn pagebuildersandwich cyberhobo akdevs infosatech munirkamal alekv proteusthemes patrickposner bouncingsprout walkerwp thecodechime jaydeep-nimavat shamim51 wp-making kaggdesign wpmoose zerozendesign webba-agency inputwp vernal wpdelicious Royal Elementor Addons BdThemes The Events Calendar (StellarWP)Themeisle

Product-Panorama Viewer- Best Plugin to Display Panoramic Images/Videos WooCommerce Variation Swatches for Products Easy Post Views Count Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer Ocean Extra CodeKit – Custom Codes Editor Form Vibes – Database Manager for Forms GFireM Advance Search STEWoo – Super Transactional Emails for WooCommerce BlockMeister – Block Pattern Builder WordPress Directory Plugin For Business Listings – WP Local Plus Airpress WP Sessions Time Monitoring Full Automatic Emails Blacklist for Everest Forms Smart Floating / Sticky Buttons – Call, Sharing, Chat Widgets & More – Buttonizer Expire tags XT Ajax Add To Cart for WooCommerce Before and After Product Images for WooCommerce Villar WP Search Filter Funnelmentals Frontend group restriction for LearnDash SEO Booster Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More Pro Broken Links Maintainer Premmerce Product Filter for WooCommerce DancePress (TRWA)Walker Core BAVOKO SEO Tools – All-in-One WordPress SEO WP Security Safe jav's – WooCommerce and Trello integration WooTrello WP School Calendar Booking Addon for WooCommerce Station Pro Product Carousel For WooCommerce – WoorouSell CartPops – High Converting Add To Cart Popup For WooCommerce Giveaways for woocommerce BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Greenshift – animation and page builder blocks Atlas – Knowledge Base WP Gratify Better Messages – Integration for WC Vendors Marketplace Blocksy Companion Qyrr – simply and modern QR-Code creation annasta Woocommerce Product Filters WP Tools Gravity Forms Divi Module Tablesome – Form DB & Automation – WPForms, Contact Form 7, Elementor, Forminator, Fluent, Gravity ClimateClick: Climate Action for all A no-code page builder for beautiful performance-based content Arendelle Market Exporter Connected Sermons Lightbox & Modal Popup WordPress Plugin – FooBox Starfish Review Generation & Marketing for WordPress WooCommerce Disable Payment Methods based on cart conditions Sticky add to cart for Woo Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider Security Ninja – Secure Firewall & Secure Malware Scanner PopOverXYZ – Show Light Weight Beautiful Tool Tips On Any Text Easy Age Verify Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar Premmerce Variation Swatches for WooCommerce Product Size Charts Plugin for WooCommerce Post Carousel Divi Age Verification Screen for WooCommerce Super Video Player- Best WordPress Video Display Plugin for mp4/OGG Simple Giveaways – Grow your business, email lists and traffic with contests HQTheme Extra Glossary Automizy Gravity Forms Extend Filter Products By Price Widget Order and Inventory Manager for WooCommerce Advanced Database Replacer Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools Livemesh Addons for Beaver Builder Abeta Link PunchOut Master Blocks – Gutenberg Site Builder Premmerce Permalink Manager for WooCommerce Shipping Method Display Style for WooCommerce Spanish Market Enhancements for WooCommerce FeedbackScout: The easiest way to collect, prioritise, manage and track customer feedback.Restaurant & Cafe Addon for Elementor Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)WordPress Slider Block Gutenslider WP Lead Stream Aquarella Lite Really Simple Featured Video – Featured video support for Posts, Pages & WooCommerce Products VidSEO | WordPress Video SEO embedder with transcripts (Youtube & Vimeo)WPMailer – The best mail builder, No More Core for your emails support Elementor, CF7 forms etc…Multi Page Auto Advance for Gravity Forms TreePress – Easy Family Trees & Ancestor Profiles Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy)3D Viewer – 3D Model Viewer Plugin Purus Display Eventbrite Events Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more APPExperts – Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps WP Event Partners – WordPress Plugin for Event and Conference Management Floating Social Share Icons and Social Share buttons – Next Previous Post Links – FL Portfolio for Elementor & Image Gallery | PowerFolio Widgets for WooCommerce Products on Elementor StoreCustomizer – A plugin to Customize all WooCommerce Pages Email Tracker – Email Tracking Plugin to track Emails for Open and Email Links Click (Compatible with WooCommerce)Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)Custom WooCommerce Checkout Fields Editor Equalize Digital Accessibility Checker – Audit Your Website for WCAG, ADA, and Section 508 Accessibility Errors Salon Booking System WooCommerce EU VAT Assistant The Events Calendar Bulk Attachment Download ListPlus – Unlimited Listing Directory Menu Item Scheduler WP Photo Effects WordPress Reviews by ReviewPress Auto SEO META keywords (META tags keywords) optimization + WooCommerce Joli Table Of Contents One Click Login Email Header Footer Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO)Woocommerce Customers Order History Image Photo Gallery Final Tiles Grid Nitek Carousel Slider Cool Transitions Easy Zillow Reviews StreamCast – Radio Player for WordPress XT Variation Swatches for WooCommerce Menu Image, Icons made easy Cryptocurrency Portfolio Tracker WS Bootstrap WP Mobile Menu – The Mobile-Friendly Responsive Menu Fast Checkout for WooCommerce Smart Variations Images & Swatches for WooCommerce MailChimp Manager Wp My Admin Bar Deals of the Day WooCommerce Hasium Responsive Social Slider Widget Page Builder Gutenberg Blocks – Kioken Blocks Page Builder Sandwich – Front End WordPress Page Builder Plugin Livemesh SiteOrigin Widgets Viralike Custom Registration and Custom Login Forms with New Recaptcha Battle Suit for Divi JDs Portfolio SV Proven Expert VO Store Locator – WP Store Locator Plugin Reset Course Progress For LearnDash Front End PM RecurWP – WordPress Recurly Payment Gateway Glorious Services & Support Shuban Ivory Search – WordPress Search Plugin Server Info Blog Sidebar Widget Agy – Age verification for WooCommerce Google Analytics plugin for WordPress by GA4WP WP EasyPay – Square for WordPress WP Munich Blocks – Gutenberg Blocks for WordPress Premmerce Wishlist for WooCommerce Nokke Broadcast Lite WP Conference Schedule Easy Newsletter Signups Alley Business Toolkit Replyable – Subscribe to Comments and Reply by Email Number Chat Country Based Payments for WooCommerce Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition Schema Plugin For Divi, Gutenberg & Shortcodes Power Ups for Elementor WordPress Everse Starter Sites – Elementor Templates Contact Form 7 Multi-Step Forms Accept Stripe Donation and Payments – AidWP Internal Link Juicer: SEO Auto Linker for WordPress Woo Ukrposhta Page Builder for Gutenberg – StarterBlocks Get feedback from visitors – WP Feedback Suite Plugin NEXUS Banner Management For WooCommerce Scheduled Notification Bar Ultimate Blocks – WordPress Blocks Plugin Genealogical Tree – WordPress Family Tree LearnMore Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Product Author for WooCommerce Lightbox – EverlightBox Gallery Impexium Single Sign On Live TV Player – Worldwide Live TV Channels Player for WordPress Price Bands for WooCommerce Vit Website Reviews Revolution for Elementor GloriousThemes Starter Sites WordPress Robots.txt optimizer (+ XML Sitemap) – Boost SEO, Traffic & Rankings Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery Go Fetch Jobs (for WP Job Manager)Geo Mashup Five-Star Ratings Shortcode Activity Log For MainWP Content Aware Sidebars – Fastest Widget Area Plugin Bani Insert or Embed Articulate Content into WordPress Radio Station by netmix® – Manage and play your Show Schedule in WordPress!Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung Tabs with Recommended Posts (Widget)Performance Kit WP BugBot Tag Groups is the Advanced Way to Display Your Taxonomy Terms RW Divi Unite Gallery WP Get Personal Advance Menu Manager Bulk WooCommerce Category Creator WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)LawPress – Law Firm Website Management TinyMCE Annotate Elation Elements for LifterLMS GFireM Fields Hooked Editable Content ConsultPress Lite FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel Categorify – WordPress Media Library Category & File Manager Restrict User Access – Ultimate Membership & Content Protection Justified Gallery Local Delivery Drivers for WooCommerce StreamWeasels Twitch Integration Focus on Reviews for WooCommerce WP Frontend Admin – Display WP Admin Pages in the Frontend Simple Sitemap – Create a Responsive HTML Sitemap Opensea Add Pinterest conversion tags for Pinterest Ads + Site verification WordPress Coupon Plugin for Bloggers and Marketers – WP Offers Cryptocurrency Product for WooCommerce Fast WordPress Extra Fees Plugin for WooCommerce Print My Blog – Print, PDF, & eBook Converter WordPress Plugin Streak CRM For Gmail For Contact Form 7 – WordPress Plugin Spotlight Social Feeds – Block, Shortcode, and Widget WP-HR Manager: The Human Resources Plugin for WordPress CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress DeMomentSomTres Grid Archive Tarot Card Oracle Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site WooCommerce Customers Table: View, Search, Bulk Editor Chat Button- Leads and Order over Chat All in One Invite Codes WP Meta and Date Remover Rating-Widget: Star Review System Surbma | GDPR Proof Cookie Consent & Notice Bar Easy Code Snippets Comments Not Replied To Image Carousel For Divi Cuisine Palace WP Radio – Worldwide Online Radio Stations Directory for WordPress Elasta Divi Collage Sparrow: Product Reviews and Ratings for WooCommerce SV Tracking Manager Ultra Elementor Addons WooCommerce Next Order Coupon WP Contact Slider Live Scores for SportsPress Past Events Extension Tiered Pricing Table for WooCommerce AnyWhere Elementor WP Coupons and Deals – WordPress Coupon Plugin Sky Login Redirect WPTools Masonry Gallery & Posts For Divi Nugget by Ingot: Easy, automated and native A/B testing for everyone WP Post Block Everse Product Options and Price Calculation Formulas for WooCommerce – Uni CPO Featured Images in RSS for Mailchimp & More FiboSearch – Ajax Search for WooCommerce Post Snippets – Custom WordPress Code Snippets Customizer WP Smart Export (Free)Coinbase Commerce – Crypto Gateway for WooCommerce WP Dev Powers – Display Screen Dimensions to Admin Plugin SSL Atlas – Free SSL Certificate & HTTPS Redirect for WordPress WP fail2ban – Advanced Security Plugin XT Floating Cart for WooCommerce Authorize.Net Payment Gateway For WooCommerce Divi Forms Styler – Gravity Forms, Fluent Forms & Contact Form 7 Multipurpose Gutenberg Block Food Store – Online Food Delivery & Pickup EthereumICO ACF for WooCommerce Product Premmerce Redirect Manager Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler KVoucher SheetPress – Manage WordPress Meta data with Google Sheets Live Drag and Drop Builder for Contact Form 7 Ultimate Widgets Light Podcast Box – Best Podcasting Plugin for WordPress Blocked in China | Check if your site is available in the Chinese mainland WP Author Bio WooCommerce upcoming Products Premmerce Brands for WooCommerce Video Player for YouTube Delete All Comments of wordpress Digital Goods for WooCommerce Checkout Bulk Edit Posts and Products in Spreadsheet Marijuana Age Verify WordPress News Plugin – TopNewsWp Premmerce WooCommerce Customers Manager CP Simple Newsletter WP Frontend Profile Easy Smooth Scroll Links – Smooth Scrolling Anchor Premmerce SEO for WooCommerce LittleBot Invoices Frontend Admin by DynamiApps Inbound Brew Checkout with Venmo on EDD Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud)WC Shop Sync – Square Payment Gateway for WooCommerce, Inventory Sync Between Square and WooCommerce, Ultimate WooCommerce Square Plugin Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)Restrict – membership, site, content and user access restrictions for WordPress TK SmugMug Slideshow Shortcode WP-Cron Status Checker Strumenti Partita IVA per Woocommerce Elementor Addons by Livemesh Primary Addon for Elementor bbResolutions Ninja Libs Amazon SES WP SPID Italia Music Player for Elementor – Audio Player & Podcast Player Knowledge Base documentation & wiki plugin – BasePress Docs Modern Addons for Elementor Page Builder Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss WP Group Promoter Widgets on Pages Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table.SVG Flags – Beautiful Scalable Flags For All Countries!Anti-Spam by Fullworks : GDPR Compliant Spam Protection Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor Delete old Posts automatically Premmerce Top Bar – PopUps – by WPOptin LMS Plugin – eLearning, Online Courses by Attest Post to Google My Business (Google Business Profile)EthPress – Web3 Login Unakit License Manager for WooCommerce Sync eCommerce NEO TK Google Fonts GDPR Compliant WP Affiliate Disclosure Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed Speculor Domain Mapping System | Create Microsites with Multiple Alias Domains (multisite optional)Ultimate Gutenberg – Custom Block Templates Widgets on Pages and Posts Payment gateway per Product for WooCommerce WP Notification Bell ConeBlog – Elementor Blog Widgets WP Free SSL – Free SSL Certificate for WordPress and force HTTPS WP Table Builder – WordPress Table Plugin Media Library File Download Easy Social Feed – Social Photos Gallery – Post Feed – Like Box Checkout with Zelle on Woocommerce WP Emaily Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Frontend Admin – Add and edit posts, pages, users and more all from the frontend NicheBase Limb Gallery | Create Beautiful Image & Video Galleries RevivePress – Keep your Old Content Evergreen Pixel Manager for WooCommerce – Track Google Analytics, Google Ads, TikTok and more Postcode Redirect W3SCloud Contact Form 7 to Zoho CRM Shared Files – Frontend File Upload Form & Secure File Sharing Grid & Styler For Contact Form 7 And Divi Block, Suspend, Report for BuddyPress Кнопка ЮMoney Change Price Title for WooCommerce ForceField Hide Shipping Method For WooCommerce WordPress SEO Checklist Events Addon for Elementor Send Prebuilt Emails WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, Security+Appointment & Event Booking Calendar Plugin – Webba Booking Delete Duplicate Posts Alt Manager Joli FAQ SEO – WordPress FAQ Plugin Change Prices with Time for WooCommerce Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress KRSP Frontend File Uploader Pay For Post with WooCommerce WooCommerce Bulk Edit Coupons – WP Sheet Editor Posts List Designer by Category – List Category Posts Or Recent Posts LocalSEOMap GFireM Action After BookPress – For Book Authors Add Expires Headers & Optimized Minify Coupon Affiliates – Affiliate Plugin for WooCommerce WP Activity Log Divi Content Restrictor Cartoon Url Events Calendar Registration Secure IP Logins Share This Image Dashy – Google Analytics advanced dashboard Amela WordPress Dev Powers – ACF Color Coded Field Types Plugin Gutenberg Blocks – ACF Blocks Suite Scrollsequence – Cinematic Scroll Image Animation Plugin Payment Gateway for PayFabric RankBear Awesome SSL Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin)South Pole: Climate action now Premmerce User Roles Add Twitter Pixel for Twitter ads Quote for WooCommerce Lite – Add to Quote Plugin Lets Customers Request Custom Quotes for Products using the Request a Quote Plugin for WooCommerce Availability datepicker – Integrate with Contact Form 7 and Divi WooCommerce PayPlug WPBITS Addons For Elementor Page Builder WP SMS Plugin – WordPress SMS Two Factor Authentication – 2FA, Two Factor, OTP SMS and Email Fullscreen Menu Fuse Social Floating Sidebar Videopack myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification Block Styler For Gravity Forms Premmerce Wholesale Pricing for WooCommerce Book BuyBack Prices Product Customer List for WooCommerce Gift Message for WooCommerce Easy Prayer Premmerce Multi-currency for Woocommerce Quick Paypal Payments Migrate WordPress Website & Backups – Prime Mover Iks Menu – WordPress Category Accordion Menu & FAQs Contact List – Premium Staff Listing, Business Directory Plugin & Address Book WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Ultimeter Ethereum Wallet SurveyFunnel – Survey Plugin for WordPress ClickerVolt – Affiliate Links & Click Tracking for Performance Marketers WordPress Translation plugin for Post, Pages & WooCommerce products. Tranzly IO AI DeepL automatic WordPress Translator.azw woocommerce file uploads DeMomentSomTres Address WordPress Persistent Login Drop Shadow Boxes Generate Images – Magic Post Thumbnail AdFoxly – Ad Manager, AdSense Ads & Ads.txt Remove Add to Cart WooCommerce Dynamic Pricing and Discount Rules for WooCommerce Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress WCC SEO Keyword Research FAQ Manager For Divi, Gutenberg Block & Shortcode Any Popup – Popup Forms, Optins & Ads Wadi Survey SlideDeck: Responsive WordPress Slider Plugin Document Viewer- Plugin to Display MS Office Docs XT Quick View for WooCommerce Place Order Without Payment for WooCommerce Better Sharing Team Collaboration Plugin for WordPress Editorial teams- Multicollab WP Travel Engine – Tour Booking Plugin – Tour Operator Software Better Elementor Addons Quick Event Manager Run Contests, Raffles, and Giveaways with ContestsWP SKT Templates – 100% free Elementor & Gutenberg templates Delivery for WooCommerce Quick Contact Form FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin Rocket Maintenance Mode & Coming Soon Page Ether and ERC20 tokens WooCommerce Payment Gateway WPVisitorInfo – Show Visitor Information & Conditional Data Based On That Information HM Multiple Roles Ultimate Carousel For Divi AFI – The Easiest Integration Plugin WP Moose Fraud Prevention For WooCommerce and EDD Best Responsive Comparison Table for Gutenberg Editor – NicheTable Add Tiktok Pixel for Tiktok ads (+Woocommerce)Contact Widgets For Elementor all the contact links you need in one place Protect Uploads with Login – Protect Your Uploads Bulk Edit and Create User Profiles – WP Sheet Editor Da Reactions Mass Pages/Posts Creator Wholesale for WooCommerce — This Wholesale Plugin Helps B2B and B2C Businesses Streamline Wholesale Products, Pricing, and User Roles, Automating their WooCommerce Wholesale Stores Quick Affiliate Store WordPress Animation Plugin – Animated Everything WPBakery Page Builder Addons by Livemesh Product Attachment for WooCommerce Announcement & Notification Banner – Bulletin All-in-One Video Gallery Social Gallery Lite Run time Image resizing WUPO Group Attributes for WooCommerce MapGeo – Interactive Geo Maps Pinblocks — Gutenberg blocks with Pinterest widgets Divi Torque Lite – Divi Theme and Extra Theme SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview SQL Reporting Services – SSRS Plugin for WordPress Get Directions Map Caxton – Create Pro page layouts in Gutenberg Ant Admin Notices for Team Better Messages – WCFM Integration Zip Code Redirect Redirection for Contact Form 7 Custom Login Page Customizer Get Better Reviews for WooCommerce New User Approve Turbo Widgets Mobile View for Responsive web design optimization (UX design) + Mobile Friendly Test Thank You Page for WooCommerce Builder for WooCommerce product reviews shortcodes – ReviewShort kk Star Ratings – Rate Post & Collect User Feedbacks Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid RaCar Clear Cart for WooCommerce DeMomentSomTres Media Tools Auto WordPress Google Translate Easy Tiktok Feed Modern Designs for Gravity Forms Easy Math Captcha for CF7 Filr – Secure document library Preloader for Divi Meridia Widget Detector for Elementor Brand Automatic YouTube Gallery Rest Routes – Custom Endpoints for WordPress REST API Purosa Yatri Tools WoowGallery – image gallery / content gallery / ecommerce gallery / social gallery / video gallery / album photo gallery WP Required Taxonomies – Categories and Tags Mandatory WordPress Books Gallery WP Disable Sitemap Add Linkedin insight tags for Linkedin ads Product Image Watermark for Woo Footer Plugin for Divi Overlay Image Divi Module Duplicate Variations for Woocommerce WooCommerce Google Analytics Integration By Advanced WC Analytics Drip Feed Content Extended for Learndash Error Log Monitor Blog Grid & Post Grid – Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry, Category Post Grid By News & Blog Designer Pack Premmerce Product Search for WooCommerce YASR – Yet Another Star Rating Plugin for WordPress Multisite Robots.txt Manager Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic)Woo Admin Product Notes Royal Elementor Addons and Templates SnazzyAdmin WP Admin Theme Social Kit wGauge – Free Version Elementor Addon Elements WooCommerce Country Catalogs – Product Country Restrictions WordPress SEO Audit Plugin – WP Site Auditor WP Tools Divi Product Carousel Ads.txt & App-ads.txt Manager for WordPress Simple Sponsorships Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce WP Page Templates Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor WordPress WooCommerce Sync for Google Sheet Booking Calendar | Appointment Booking | Bookit Flat Rate Shipping Plugin For WooCommerce Guestofy – Restaurant Reservations Plugin, Room Planer, Reservation Form WP Link Bio WordPress Dev Powers – Element Selector jQuery Powers Plugin Full Page Blog Designer TwentyFourth WP Scraper Block Slider – Responsive Image Slider, Video Slider & Post Slider Enhanced Ecommerce Google Analytics for WooCommerce Widget for Contact form 7 Stackable – Page Builder Gutenberg Blocks Simple Feature Requests Free – User Feedback Board BlockyPage – Gutenberg Based Page Builder WP AutoMedic Gallery PhotoBlocks Contact Form 7 – Capsule CRM – Integration Event Tickets and Registration Easy Settings for LearnDash WordPress Auto SEO Plugin – Upfiv SEO Wizard WP Relevant Ads Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook User Menus – Nav Menu Visibility LittleBot ACH for Stripe + Plaid Under Construction Master Accordion ( Former WP Awesome FAQ Plugin )XT Points & Rewards for WooCommerce CF7 Constant Contact Fields Mapping WP Data Access – WordPress App, Table and Form Builder plugin Passster – Password Protect Pages and Content Out of stock display for woocommerce Clean Social Icons Checkout with Cash App on EDD AutoSave Net SSL Certificate – Free SSL, HTTPS by SSL Zen Gateway for PayLate on WooCommerce Court Reservation – Manage Your Court Bookings Online Affiliate Link Builder Plugin for Amazon Associates – Review Engine Advanced Custom Fields options import/export RT Easy Builder – Advanced addons for Elementor The best plugin for restrict content, support all Custom Post Types and Elementor – Password Protected Choice Payment Gateway for WooCommerce URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress WooCommerce Shipping gateway per Product WP Tools Divi Blog Carousel Simple Social Page Widget & Shortcode Ultimate Bulk SEO Noindex Nofollow – Speed up Penalty Recovery Ultimate SEO Booster Education Addon for Elementor Advanced Classifieds & Directory Pro Code Manager HuCommerce | Magyar WooCommerce kiegészítések Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking Feedpress Generator – External RSS Frontend Customizer STAX Header Builder WP Google Street View (with 360° virtual tour) & Google maps + Local SEO Ultimate Divi Modules Suite – Divi Sumo Lite WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule FIT: Featured Image Toolkit Conversion de moneda Woocommerce WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters WooCommerce Bulk Edit Products – WP Sheet Editor WP Sierra WordPress Gallery Plugin – Edge Photo Gallery Pootle Pagebuilder – WordPress Page builder Tickera – WordPress Event Ticketing

CWE ID-CWE-862

Missing Authorization

CVE-2024-47392

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.06% / 20.11%

7 Day CHG~0.00%

Published-05 Oct, 2024 | 14:42

Updated-22 Jan, 2025 | 18:25

WordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.7.5.

Vendor-BdThemes BdThemes

Product-element_pack Element Pack Elementor Addons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-47629

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.08% / 23.34%

7 Day CHG~0.00%

Published-05 Oct, 2024 | 13:21

Updated-07 Oct, 2024 | 17:47

WordPress Ultimate Store Kit Elementor Addons plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.0.5.

Vendor-BdThemes

Product-Ultimate Store Kit Elementor Addons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-8030

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-9.8||CRITICAL

EPSS-48.27% / 97.65%

7 Day CHG~0.00%

Published-28 Aug, 2024 | 02:05

Updated-10 Jul, 2025 | 15:30

Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object Injection

The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_wishlist cookie in versions up to , and including, 2.0.3. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to delete arbitrary files, retrieve sensitive data, or execute code.

Vendor-BdThemes

Product-ultimate_store_kit Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider utlimate_store_kit_elementor_addons

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2024-5335

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-9.8||CRITICAL

EPSS-21.65% / 95.51%

7 Day CHG~0.00%

Published-21 Aug, 2024 | 08:29

Updated-10 Jul, 2025 | 15:31

Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection

The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_compare_products cookie in versions up to , and including, 1.6.4. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to delete arbitrary files, retrieve sensitive data, or execute code.

Vendor-BdThemes

Product-ultimate_store_kit Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2024-43342

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.06% / 20.11%

7 Day CHG~0.00%

Published-18 Aug, 2024 | 13:22

Updated-13 Sep, 2024 | 14:11

WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability

Vendor-BdThemes BdThemes

Product-ultimate_store_kit Ultimate Store Kit Elementor Addons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-7247

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.17% / 38.25%

7 Day CHG~0.00%

Published-13 Aug, 2024 | 05:30

Updated-29 Jan, 2025 | 15:29

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Gallery and Countdown widgets in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-4359

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.5||MEDIUM

EPSS-0.59% / 68.08%

7 Day CHG~0.00%

Published-09 Aug, 2024 | 04:29

Updated-29 Jan, 2025 | 15:44

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 5.7.2 via the SVG widget and a lack of sufficient file validation in the render_svg function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CWE ID-CWE-829

Inclusion of Functionality from Untrusted Control Sphere

CVE-2024-4360

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.09% / 26.25%

7 Day CHG~0.00%

Published-09 Aug, 2024 | 04:29

Updated-29 Jan, 2025 | 15:45

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user supplied attributes like 'title_tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-4643

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.08% / 23.39%

7 Day CHG~0.00%

Published-02 Aug, 2024 | 09:29

Updated-29 Jan, 2025 | 15:44

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘end_redirect_link’ parameter in versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-39667

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.08% / 23.53%

7 Day CHG~0.00%

Published-01 Aug, 2024 | 21:33

Updated-22 Jan, 2025 | 22:10

WordPress Element Pack Elementor Addons plugin <= 5.6.11 - Cross Site Scripting (XSS) vulnerability

Vendor-BdThemes BdThemes

Product-element_pack Element Pack Elementor Addons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-2455

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.07% / 21.23%

7 Day CHG~0.00%

Published-01 Aug, 2024 | 12:43

Updated-06 Feb, 2025 | 17:46

Element Pack - Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL

The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget wrapper link URL in all versions up to, and including, 7.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BDThemes BdThemes

Product-element_pack Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-5555

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.24% / 47.39%

7 Day CHG+0.01%

Published-18 Jul, 2024 | 08:33

Updated-22 Aug, 2024 | 16:46

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘social-link-title’ parameter in all versions up to, and including, 5.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-5554

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.37% / 58.09%

7 Day CHG+0.26%

Published-18 Jul, 2024 | 08:33

Updated-22 Aug, 2024 | 16:43

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘onclick_event’ parameter in all versions up to, and including, 5.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-5662

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.25% / 48.54%

7 Day CHG~0.00%

Published-28 Jun, 2024 | 08:33

Updated-01 Aug, 2024 | 21:18

Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget

The Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the Social Count (Static) widget in all versions up to, and including, 3.11.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud)

CVE-2024-3925

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.23% / 45.68%

7 Day CHG~0.00%

Published-12 Jun, 2024 | 07:32

Updated-29 Jan, 2025 | 15:31

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 5.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-element_pack Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-5640

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.27% / 49.71%

7 Day CHG+0.01%

Published-07 Jun, 2024 | 04:33

Updated-28 Oct, 2024 | 18:32

Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget

The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ attribute within the Pacific widget in all versions up to, and including, 3.14.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-prime_slider Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33568

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-8.5||HIGH

EPSS-0.55% / 66.75%

7 Day CHG~0.00%

Published-04 Jun, 2024 | 13:12

Updated-26 Feb, 2025 | 13:15

WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3.

Vendor-BdThemes BdThemes

Product-element_pack Element Pack Pro

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2024-3997

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.15% / 35.87%

7 Day CHG~0.00%

Published-23 May, 2024 | 11:02

Updated-03 Feb, 2025 | 18:03

Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget

The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pagepiling widget in all versions up to, and including, 3.14.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-prime_slider Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)prime_slider

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-3926

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.27% / 49.71%

7 Day CHG~0.00%

Published-22 May, 2024 | 14:32

Updated-01 Aug, 2024 | 20:26

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes value in widgets in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CVE-2024-3927

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.51% / 65.43%

7 Day CHG~0.00%

Published-22 May, 2024 | 06:50

Updated-01 Aug, 2024 | 20:26

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form.

Vendor-BdThemes

Product-Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)

CVE-2024-4339

Assigner-Wordfence

View Details

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.13% / 33.27%

7 Day CHG~0.00%

Published-09 May, 2024 | 20:03

Updated-03 Feb, 2025 | 18:36

Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the General widget in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-BdThemes

Product-prime_slider Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-4606

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-5.4||MEDIUM

EPSS-0.19% / 41.27%

7 Day CHG~0.00%

Published-09 May, 2024 | 11:59

Updated-28 Aug, 2024 | 08:15

WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.0.3.

Vendor-BdThemes BdThemes

Product-Ultimate Store Kit Elementor Addons utlimate_store_kit_elementor_addons

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2024-32681

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.92%

7 Day CHG~0.00%

Published-22 Apr, 2024 | 10:41

Updated-04 Feb, 2025 | 15:39

WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.

Vendor-BdThemes elementor BdThemes

Product-prime_slider Prime Slider – Addons For Elementor elementor

CWE ID-CWE-862

Missing Authorization

CVE-2024-32682

Assigner-Patchstack

View Details

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.27% / 49.91%

7 Day CHG~0.00%

Published-22 Apr, 2024 | 10:40

Updated-04 Feb, 2025 | 15:39

WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.

Vendor-BdThemes BdThemes

Product-prime_slider Prime Slider – Addons For Elementor prime_slider

CWE ID-CWE-862

Missing Authorization