Biplob018 vulnerabilities
12 vulnerabilities
Known vulnerabilities in Biplob018 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.
Products
7- Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison Or Magnifier)3 vulnerabilities
- Image Hover Effects For Elementor With Lightbox And Flipbox2 vulnerabilities
- Shortcode Addons2 vulnerabilities
- Shortcode Addons (Wordpress Plugin)2 vulnerabilities
- Image Hover Effects Caption Hover With Carousel1 vulnerabilities
- Image Hover Effects Ultimate1 vulnerabilities
- Team Showcase And Slider – Team Members Builder1 vulnerabilities
CVE-2022-2937biplob018image hover effects ultimate+2
EPSS score0.63%
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.CVE-2022-2936biplob018image hover effects ultimate (image gallery, effects, lightbox, comparison or magnifier)+2EPSS score0.63%
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.CVE-2022-2935biplob018image hover effects ultimate (image gallery, effects, lightbox, comparison or magnifier)+2EPSS score0.61%
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image URL value that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.CVE-2022-4207biplob018image hover effects ultimate (image gallery, effects, lightbox, comparison or magnifier)+2EPSS score0.57%
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.CVE-2022-45831biplob018image hover effects for elementor with lightbox and flipbox+2EPSS score0.41%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in biplob018 Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 2.8 versions.CVE-2022-34487biplob018shortcode addons (wordpress plugin)+2EPSS score3.35%
Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.CVE-2022-33970biplob018shortcode addons (wordpress plugin)+2EPSS score1.14%
Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress.CVE-2024-51763biplob018team showcase and slider – team members builder+1EPSS score0.29%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biplob018 Team Showcase and Slider – Team Members Builder team-showcase-ultimate allows Reflected XSS.This issue affects Team Showcase and Slider – Team Members Builder: from n/a through <= 1.3.CVE-2024-31114biplob018shortcode addons+1EPSS score1.35%
Unrestricted Upload of File with Dangerous Type vulnerability in biplob018 Shortcode Addons.This issue affects Shortcode Addons: from n/a through 3.2.5.CVE-2024-37121biplob018shortcode addons+2EPSS score0.28%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Shortcode Addons allows Stored XSS.This issue affects Shortcode Addons: from n/a through 3.2.5.CVE-2024-37546biplob018image hover effects - caption hover with carousel+1EPSS score0.24%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Image Hover Effects - Caption Hover with Carousel allows Stored XSS.This issue affects Image Hover Effects - Caption Hover with Carousel: from n/a through 3.0.2.CVE-2024-5001biplob018image hover effects for elementor with lightbox and flipbox+2EPSS score0.32%
The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id', 'oxi_addons_f_title_tag', and 'content_description_tag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37546 may be a duplicate of this issue.