Pwrplugins
Monthly
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Stored cross-site scripting in Magic Buttons for Elementor WordPress plugin versions ≤1.0 allows authenticated attackers with Contributor-level access to inject arbitrary scripts via the magic-button shortcode, executing in the browsers of any user viewing the affected page. No active exploitation or public exploit code is known, and EPSS probability is extremely low (0.03%).
Stored cross-site scripting vulnerability in the Magic Buttons for Elementor WordPress plugin allows authenticated attackers with contributor-level access to inject arbitrary web scripts via the magic-button shortcode. The flaw exists in all versions up to and including 1.0 due to insufficient input sanitization. No public exploit has been identified, and EPSS score is very low (0.03%), indicating minimal exploitation risk at this time.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery for WordPress | PowerFolio allows Stored XSS.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Stored cross-site scripting in Magic Buttons for Elementor WordPress plugin versions ≤1.0 allows authenticated attackers with Contributor-level access to inject arbitrary scripts via the magic-button shortcode, executing in the browsers of any user viewing the affected page. No active exploitation or public exploit code is known, and EPSS probability is extremely low (0.03%).
Stored cross-site scripting vulnerability in the Magic Buttons for Elementor WordPress plugin allows authenticated attackers with contributor-level access to inject arbitrary web scripts via the magic-button shortcode. The flaw exists in all versions up to and including 1.0 due to insufficient input sanitization. No public exploit has been identified, and EPSS score is very low (0.03%), indicating minimal exploitation risk at this time.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery for WordPress | PowerFolio allows Stored XSS.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.