| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-42715 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions. | ||
| CVE-2026-42712 | Hig | 0.55 | 8.5 | 0.00 | Oct 10, 2026 | Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. | ||
| CVE-2026-42711 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions. | ||
| CVE-2026-42709 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions. | ||
| CVE-2026-42706 | Hig | 0.49 | 7.5 | 0.00 | Oct 10, 2026 | Unauthenticated Broken Access Control in DK <= 3.2.1 versions. | ||
| CVE-2026-42705 | Hig | 0.49 | 7.5 | 0.00 | Oct 10, 2026 | Unauthenticated Broken Access Control in Grand News <= 3.4 versions. | ||
| CVE-2026-42704 | Hig | 0.53 | 8.1 | 0.00 | Oct 10, 2026 | Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. | ||
| CVE-2026-42702 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0. | ||
| CVE-2026-42699 | Hig | 0.39 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions. | ||
| CVE-2026-42697 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through… | ||
| CVE-2026-42693 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. | ||
| CVE-2026-42633 | Hig | 0.55 | 8.5 | 0.00 | Oct 10, 2026 | Subscriber SQL Injection in Events Manager <= 7.4.6 versions. | ||
| CVE-2026-42632 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions. | ||
| CVE-2026-42631 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. | ||
| CVE-2026-42630 | Hig | 0.49 | 7.5 | 0.00 | Oct 10, 2026 | Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. | ||
| CVE-2026-40805 | Hig | 0.50 | 7.7 | 0.00 | Oct 10, 2026 | Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. | ||
| CVE-2026-40803 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions. | ||
| CVE-2026-40802 | Hig | 0.49 | 7.6 | 0.00 | Oct 10, 2026 | Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | ||
| CVE-2026-40801 | Hig | 0.53 | 8.1 | 0.00 | Oct 10, 2026 | Subscriber Broken Access Control in Wordable <= 8.2.10 versions. | ||
| CVE-2026-40777 | Hig | 0.53 | 8.1 | 0.00 | Oct 10, 2026 | Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | ||
| CVE-2026-39802 | Hig | 0.53 | 8.1 | 0.00 | Oct 10, 2026 | Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions. | ||
| CVE-2026-39800 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions. | ||
| CVE-2026-39799 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions. | ||
| CVE-2026-27350 | Hig | 0.47 | 7.2 | 0.00 | Oct 10, 2026 | Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta. | ||
| CVE-2026-96341 | Hig | 0.53 | 8.2 | 0.00 | Oct 10, 2026 | Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3. | ||
| CVE-2026-57806 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through… | ||
| CVE-2026-94160 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4. | ||
| CVE-2026-62044 | Hig | 0.47 | 7.2 | 0.00 | Oct 10, 2026 | Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13. | ||
| CVE-2026-106609 | Hig | 0.49 | 7.5 | 0.00 | Oct 10, 2026 | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2. | ||
| CVE-2026-106608 | Hig | 0.47 | 7.2 | 0.00 | Oct 10, 2026 | Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2. | ||
| CVE-2026-103071 | Hig | 0.49 | 7.5 | 0.00 | Oct 10, 2026 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3. | ||
| CVE-2026-108553 | Hig | 0.42 | 7.5 | 0.00 | Oct 10, 2026 | OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter,… | ||
| CVE-2026-108550 | Hig | 0.50 | 8.8 | 0.00 | Oct 10, 2026 | SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target… | ||
| CVE-2026-108549 | Hig | 0.46 | 8.1 | 0.00 | Oct 10, 2026 | cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can… | ||
| CVE-2026-108548 | Hig | 0.40 | 7.3 | 0.00 | Oct 10, 2026 | AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/… | ||
| CVE-2026-108546 | Hig | 0.42 | 7.5 | 0.01 | Oct 10, 2026 | Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title,… | ||
| CVE-2026-97264 | Hig | 0.39 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4. | ||
| CVE-2026-97263 | Hig | 0.39 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4. | ||
| CVE-2026-94676 | Hig | 0.47 | 7.2 | 0.00 | Oct 10, 2026 | Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0. | ||
| CVE-2026-108161 | Hig | 0.42 | 7.5 | 0.01 | Oct 10, 2026 | FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can… | ||
| CVE-2026-105885 | Hig | 0.57 | 8.8 | 0.00 | Oct 10, 2026 | Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62. | ||
| CVE-2026-102388 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3. | ||
| CVE-2026-107794 | Hig | 0.42 | 7.5 | 0.00 | Oct 10, 2026 | ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note… | ||
| CVE-2013-10076 | Hig | 0.42 | 7.5 | 0.00 | Oct 10, 2026 | ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. | ||
| CVE-2026-103636 | Hig | 0.42 | 7.5 | 0.00 | Oct 10, 2026 | Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a… | ||
| CVE-2026-91136 | Hig | 0.49 | 7.5 | 0.03 | Oct 10, 2026 | The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback… | ||
| CVE-2026-107657 | Hig | 0.40 | 7.2 | 0.00 | Oct 10, 2026 | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient… | ||
| CVE-2026-96765 | Hig | 0.40 | 7.2 | 0.00 | Oct 10, 2026 | The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This… | ||
| CVE-2026-96662 | Hig | 0.49 | 7.5 | 0.00 | Oct 10, 2026 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied… | ||
| CVE-2026-96278 | Hig | 0.47 | 7.2 | 0.00 | Oct 10, 2026 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
- risk 0.55cvss 8.5epss 0.00
Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
- risk 0.39cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.
- risk 0.55cvss 8.5epss 0.00
Subscriber SQL Injection in Events Manager <= 7.4.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.
- risk 0.50cvss 7.7epss 0.00
Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.
- risk 0.49cvss 7.6epss 0.00
Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions.
- risk 0.53cvss 8.1epss 0.00
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
- risk 0.53cvss 8.1epss 0.00
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
- risk 0.47cvss 7.2epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.
- risk 0.53cvss 8.2epss 0.00
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through…
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.
- risk 0.47cvss 7.2epss 0.00
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
- risk 0.49cvss 7.5epss 0.00
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
- risk 0.47cvss 7.2epss 0.00
Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.
- risk 0.49cvss 7.5epss 0.00
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.
- risk 0.42cvss 7.5epss 0.00
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter,…
- risk 0.50cvss 8.8epss 0.00
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target…
- risk 0.46cvss 8.1epss 0.00
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can…
- risk 0.40cvss 7.3epss 0.00
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/…
- risk 0.42cvss 7.5epss 0.01
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title,…
- risk 0.39cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.
- risk 0.39cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.
- risk 0.47cvss 7.2epss 0.00
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
- risk 0.42cvss 7.5epss 0.01
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can…
- risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.
- risk 0.42cvss 7.5epss 0.00
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note…
- risk 0.42cvss 7.5epss 0.00
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.
- risk 0.42cvss 7.5epss 0.00
Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a…
- risk 0.49cvss 7.5epss 0.03
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback…
- risk 0.40cvss 7.2epss 0.00
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient…
- risk 0.40cvss 7.2epss 0.00
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This…
- risk 0.49cvss 7.5epss 0.00
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied…
- risk 0.47cvss 7.2epss 0.00
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…