Zer0Gh0St

Stored Cross-Site Scripting occurs via form submission fields due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the map options. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

The Animation Addons for Elementor plugin for WordPress contains a DOM-Based Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping of multiple parameters. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Name of the Vulnerable Software and Affected Versions: WP Recipe Maker plugin for WordPress versions up to, and including, 9.8.0 Description: The issue is related to Stored Cross-Site Scripting via the Roundup Recipe Name field due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Recommendations: For WP Recipe Maker plugin for WordPress versions up to, and including, 9.8.0, update to a version later than 9.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the Roundup Recipe Name field to minimize the risk of exploitation.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in several widgets. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the Countdown, Syntax Highlighter, and Page Scroll widgets. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the Embedded Video(PB) widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `Name` and `Comment` field when commenting on photo gallery entries due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Animated Text and Image Comparison Widgets. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's Profile Card widget, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the `data-marker` parameter. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's Writing Effect Headline shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `border`, `margin`, and `gap` parameters due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was initially patched in version 2.4.8 but was reintroduced in version 2.4.9 with the removal of the `wp kses post()` built-in WordPress sanitization function.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The `from` and `subject` parameters are specifically vulnerable to this type of attack.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping of a `campaign name`. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the `message` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.