Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
BlossomThemes Social Feed
Vendor
blossomthemes
Product
BlossomThemes Social Feed
Platforms
Unknown
Default status
unaffected
BlossomThemes Social Feed · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.0.5
None listed
Carousel Slider
Vendor
sayful
Product
Carousel Slider
Platforms
Unknown
Default status
unaffected
Carousel Slider · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.2.14
None listed
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
Vendor
divisupreme
Product
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
Platforms
Unknown
Default status
unaffected
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.5.52
None listed
Robo Gallery – Photo & Image Slider
Vendor
robosoft
Product
Robo Gallery – Photo & Image Slider
Platforms
Unknown
Default status
unaffected
Robo Gallery – Photo & Image Slider · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.2.22
None listed
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor
Vendor
gutentor
Product
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor
Platforms
Unknown
Default status
unaffected
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.4.9
None listed
OceanWP
Vendor
oceanwp
Product
OceanWP
Platforms
Unknown
Default status
unaffected
OceanWP · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.6.0
None listed
Happy Addons for Elementor
Vendor
leevio
Product
Happy Addons for Elementor
Platforms
Unknown
Default status
unaffected
Happy Addons for Elementor · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.12.2
None listed
Divi Torque Lite
Vendor
badhonrocks
Product
Divi Torque Lite
Platforms
Unknown
Default status
unaffected
Divi Torque Lite · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
4.0.5
None listed
Divi Builder
Vendor
Elegant Themes
Product
Divi Builder
Platforms
Unknown
Default status
unaffected
Divi Builder · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
4.27.1
None listed
Divi
Vendor
Elegant Themes
Product
Divi
Platforms
Unknown
Default status
unaffected
Divi · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
4.27.1
None listed
Divi Extra
Vendor
Elegant Themes
Product
Divi Extra
Platforms
Unknown
Default status
unaffected
Divi Extra · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
4.27.1
None listed
Bold Page Builder
Vendor
boldthemes
Product
Bold Page Builder
Platforms
Unknown
Default status
unaffected
Bold Page Builder · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.1.2
None listed
Essential Addons for Elementor – Popular Elementor Templates & Widgets
Vendor
wpdevteam
Product
Essential Addons for Elementor – Popular Elementor Templates & Widgets
Platforms
Unknown
Default status
unaffected
Essential Addons for Elementor – Popular Elementor Templates & Widgets · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
6.0.4
None listed
Shortcodes Ultimate – Content Elements
Vendor
gn_themes
Product
Shortcodes Ultimate – Content Elements
Platforms
Unknown
Default status
unaffected
Shortcodes Ultimate – Content Elements · Scoped product and version facts