CVE Vulnerability Catalog

The LeadBI plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.7. This is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts.

An authorization bypass through a user-controlled key vulnerability in the favethemes Houzez plugin allows exploitation of incorrectly configured access control security levels. This issue affects Houzez versions up to and including 4.2.5.

The Templazee plugin through version 1.0.2 contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels.

Fusion Builder up to version 3.13.2 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.

Stored XSS vulnerability in JetElements For Elementor up to version 2.7.8. An attacker can inject a malicious script that gets stored and executed in the user's browser.

Stored XSS vulnerability in JetEngine up to version 3.7.3. An attacker can inject a persistent script that executes in users' browsers.

The Smash Balloon Social Post Feed plugin by Syed Balkhi is vulnerable to Missing Authorization in versions from n/a through 4.3.2. This issue allows exploiting incorrectly configured access control security levels.

DOM-Based XSS vulnerability in WoodMart theme before version 8.3.2. An attacker can exploit it to execute a script in the victim's browser.

Stored XSS vulnerability in JetBlocks For Elementor up to version 1.3.18. An attacker can store a malicious script that executes when the page is viewed.

Reflected XSS vulnerability in JetBlog up to version 2.4.4. An attacker can send a crafted link that executes a script in the victim's browser.

Stored XSS vulnerability in JetBlog up to version 2.4.4.1. An attacker can store a malicious script that executes when the page is viewed.

The Ultimate Blocks plugin for WordPress in versions up to and including 3.3.6 is vulnerable to stored XSS due to improper neutralization of input during web page generation.

DOM-Based XSS vulnerability in JetWooBuilder up to version 2.1.20. An attacker can exploit it to execute a script in the victim's browser.

Stored XSS vulnerability in JetWooBuilder up to version 2.1.20.1. An attacker can store a malicious script that executes when the page is viewed.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS. This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.

The WPeMatico RSS Feed Fetcher plugin by etruel is vulnerable to Missing Authorization in versions from n/a through 2.8.3. This issue allows exploiting incorrectly configured access control security levels.

The Web Accessibility By accessiBe plugin (versions up to 2.10) has a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

Server-Side Request Forgery (SSRF) vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery. This issue affects Icegram Express Pro: from n/a through <= 5.9.5.

The CoSchedule plugin by CoSchedule (coschedule-by-todaymade) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects CoSchedule versions up to and including 3.4.0.

The Email Subscription Popup plugin (versions up to and including 1.2.26) is vulnerable to stored cross-site scripting (XSS) due to improper neutralization of input during web page generation. Malicious code can be stored and executed by users viewing the page.