GCVE - cpe:2.3:a:leap13:premium_addons:*:*:*:*:pro:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:leap13:premium_addons:*:*:*:*:pro:wordpress:*:*

part: a version: * update: *

Vendor	Leap13 (`cd2fbc37-8c51-5ca2-b4af-3e1142efa0b9`)
Product	Premium Addons (`7833ef38-5487-5386-9401-f2317f9ca55c`)
Edition	*
Language	*
Software edition	pro
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-2239`	vulnerable	2026-06-08 06:33:30.683755	Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module MEDIUM (6.4) The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-03-13T15:32:37.901Z Updated: 2026-04-08T16:42:23.064Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/254f3a1c-0d5d-499b-9da7-129f21ba70af?source=cve https://premiumaddons.com/change-log/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2238`	vulnerable	2026-06-08 06:33:30.683417	Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor Module MEDIUM (6.4) The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-03-13T15:32:39.917Z Updated: 2026-04-08T17:04:03.845Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/82e5fd9f-9a1f-4a4c-ac06-61bf65e3c8ab?source=cve https://premiumaddons.com/change-log/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2237`	vulnerable	2026-06-08 06:33:30.683075	Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module MEDIUM (6.4) The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-03-13T15:32:38.512Z Updated: 2026-04-08T16:45:54.408Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/35151561-6a80-4c2c-b87a-2dfe02aa6158?source=cve https://premiumaddons.com/change-log/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2000`	vulnerable	2026-06-08 06:33:30.063944	Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multi Scroll Widget MEDIUM (6.4) The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi Scroll Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-03-13T15:32:40.870Z Updated: 2026-04-08T17:31:51.096Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/eee517de-a47e-47c9-8322-92ce772191b0?source=cve https://premiumaddons.com/change-log/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1997`	vulnerable	2026-06-08 06:27:15.215849	Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Messenger Chat Widget MEDIUM (6.4) The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Messenger Chat Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-03-13T15:32:39.456Z Updated: 2026-04-08T17:00:15.655Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/6ffa6a6b-bbb4-4361-8585-ce2cdb7d1d7e?source=cve https://premiumaddons.com/change-log/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1996`	vulnerable	2026-06-08 06:27:15.215250	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-37869`	vulnerable	2026-06-08 06:08:16.054379	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-37868`	vulnerable	2026-06-08 06:08:16.053193	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.