VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,228 total · sorted by risk
  • CVE-2025-62069MedOct 22, 2025
    WordPress
    Wp Meta Data Filter And Taxonomy Filter
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.This issue affects MDTF: from n/a through <= 1.3.3.8.

  • CVE-2025-62068MedOct 22, 2025
    E2pdf
    E2pdf
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.28.09.

  • CVE-2025-62063MedOct 22, 2025
    WordPress
    WP Travel Gutenberg Blocks
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.9.2.

  • CVE-2025-62060MedOct 22, 2025
    WordPress
    Tab Ultimate
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Tab Ultimate tabs-pro.This issue affects Tab Ultimate: from n/a through <= 1.8.

  • CVE-2025-62058MedOct 22, 2025
    WordPress
    Houzez Theme Functionality
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

  • CVE-2025-62042MedOct 22, 2025
    WordPress
    Event Post
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.10.3.

  • CVE-2025-62024MedOct 22, 2025
    WordPress
    Pie Calendar
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar.This issue affects Pie Calendar: from n/a through <= 1.2.9.

  • CVE-2025-62019MedOct 22, 2025
    WordPress
    Recipe Card Blocks for Gutenberg & Elementor
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.

  • CVE-2025-53424MedOct 22, 2025
    WordPress
    WooCommerce Orders & Customers Exporter
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.

  • CVE-2025-53421MedOct 22, 2025
    WordPress
    Accordion
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.

  • CVE-2025-52757MedOct 22, 2025
    Fantasticplugins
    SUMO Memberships for WooCommerce
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

  • CVE-2025-52752MedOct 22, 2025
    WordPress
    IDonatePro
    risk 0.42cvss 6.5epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.

  • CVE-2025-52738MedOct 22, 2025
    Wikimedia Foundation
    Wikipedia Preview
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.

  • CVE-2025-49961MedOct 22, 2025
    WordPress
    Breeze Checkout
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Breeze Team Breeze Checkout breeze-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze Checkout: from n/a through <= 1.4.0.

  • CVE-2025-49960MedOct 22, 2025
    WordPress
    LeadBI Plugin
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leadbi LeadBI Plugin for WordPress leadbi allows Stored XSS.This issue affects LeadBI Plugin for WordPress: from n/a through <= 1.7.

  • CVE-2025-49952MedOct 22, 2025
    WordPress
    Houzez
    risk 0.42cvss 6.5epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.

  • CVE-2025-49940MedOct 22, 2025
    WordPress
    Fusion Builder
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Based XSS.This issue affects Fusion Builder: from n/a through <= 3.13.2.

  • CVE-2025-49939MedOct 22, 2025
    WordPress
    JetElements For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.8.

  • CVE-2025-49938MedOct 22, 2025
    Crocoblock
    Jetengine
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.

  • CVE-2025-49936MedOct 22, 2025
    WordPress
    Woodmart
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through < 8.3.2.

  • CVE-2025-49934MedOct 22, 2025
    WordPress
    JetBlocks For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.

  • CVE-2025-49933MedOct 22, 2025
    Crocoblock
    JetBlog
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through <= 2.4.4.

  • CVE-2025-49932MedOct 22, 2025
    Crocoblock
    JetBlog
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Stored XSS.This issue affects JetBlog: from n/a through <= 2.4.4.1.

  • CVE-2025-49929MedOct 22, 2025
    WordPress
    Ultimate Blocks
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows Stored XSS.This issue affects Ultimate Blocks: from n/a through <= 3.3.6.

  • CVE-2025-49928MedOct 22, 2025
    WordPress
    JetWooBuilder
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows DOM-Based XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.

  • CVE-2025-49927MedOct 22, 2025
    WordPress
    JetWooBuilder
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Stored XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.1.

  • CVE-2025-49908MedOct 22, 2025
    WordPress
    WPC Countdown Timer for WooCommerce
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4.

  • CVE-2025-48096MedOct 22, 2025
    WordPress
    My Custom CSS
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0.

  • CVE-2025-11883MedOct 22, 2025
    WordPress
    Responsive Progress Bar
    risk 0.42cvss 6.4epss 0.00

    The Responsive Progress Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rprogress shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2025-11880MedOct 22, 2025
    WordPress
    Widget Countdown
    risk 0.42cvss 6.4epss 0.00

    The SM CountDown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's smcountdown shortcode in versions less than, or equal to, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2025-11878MedOct 22, 2025
    WordPress
    WP Categories Widget
    risk 0.42cvss 6.4epss 0.00

    The ST Categories Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's st-categories shortcode in versions less than, or equal to, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2025-11872MedOct 22, 2025
    WordPress
    Material Design Iconic Font Integration
    risk 0.42cvss 6.4epss 0.00

    The Material Design Iconic Font Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdiconic' shortcode in all versions up to, and including, 2 due to insufficient input sanitization and output escaping on user supplied attributes.…

  • CVE-2025-11870MedOct 22, 2025
    WordPress
    Simple Business Data
    risk 0.42cvss 6.4epss 0.00

    The Simple Business Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'simple_business_data' shortcode attributes in all versions up to, and including, 1.0.1. This is due to the plugin not properly sanitizing user input or escaping output when embedding…

  • CVE-2025-11867MedOct 22, 2025
    WordPress
    Bg Book Publisher
    risk 0.42cvss 6.4epss 0.00

    The Bg Book Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `book_author` post meta, rendered through the `[book_author]` shortcode, in all versions up to, and including, 1.25. This is due to the plugin not properly escaping the meta value…

  • CVE-2025-11866MedOct 22, 2025
    WordPress
    Photographers Galleries
    risk 0.42cvss 6.4epss 0.00

    The Photographers galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes (`w`, `h`, `raw_css`, `look`, etc.) in all versions up to, and including, 1.1.8. This is due to the plugin not properly sanitizing user input or…

  • CVE-2025-11834MedOct 22, 2025
    WordPress
    Wp AD Gallery
    risk 0.42cvss 6.4epss 0.00

    The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible…

  • CVE-2025-11830MedOct 22, 2025
    WordPress
    Wp Restaurant Listings
    risk 0.42cvss 6.4epss 0.00

    The WP Restaurant Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter of the restaurant_summary shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping. This makes…

  • CVE-2025-11827MedOct 22, 2025
    WordPress
    Oboxmedia Ads
    risk 0.42cvss 6.4epss 0.00

    The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_widget' and 'after_widget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output…

  • CVE-2025-11825MedOct 22, 2025
    WordPress
    Playerzbr
    risk 0.42cvss 6.4epss 0.00

    The Playerzbr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'urlmeta' post meta field in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2025-11819MedOct 22, 2025
    WordPress
    Wp Thumbnail
    risk 0.42cvss 6.4epss 0.00

    The WP-Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'roboshot' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2025-11818MedOct 22, 2025
    WordPress
    Wp Responsive Meet The Team
    risk 0.42cvss 6.4epss 0.00

    The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprm_team' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2025-11817MedOct 22, 2025
    WordPress
    Simple Tableau Viz
    risk 0.42cvss 6.4epss 0.00

    The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2025-11813MedOct 22, 2025
    WordPress
    Responsive Iframe Googlemap
    risk 0.42cvss 6.4epss 0.00

    The Responsive iframe GoogleMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive_map' shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on the 'width' and 'height'…

  • CVE-2025-11811MedOct 22, 2025
    WordPress
    Simple Youtube Shortcode
    risk 0.42cvss 6.4epss 0.00

    The Simple Youtube Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embed_youtube' shortcode in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping on the 'id' attribute. This makes it…

  • CVE-2025-11810MedOct 22, 2025
    WordPress
    Print Button Shortcode
    risk 0.42cvss 6.4epss 0.00

    The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'target' attribute. This makes it…

  • CVE-2025-11809MedOct 22, 2025
    WordPress
    Wp Force Images Download
    risk 0.42cvss 6.4epss 0.00

    The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible…

  • CVE-2025-11807MedOct 22, 2025
    WordPress
    Mixlr Shortcode
    risk 0.42cvss 6.4epss 0.00

    The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'url' attribute. This makes it possible for…

  • CVE-2025-11804MedOct 22, 2025
    WordPress
    Jb News Ticker
    risk 0.42cvss 6.4epss 0.00

    The JB News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'jbticker' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible…

  • CVE-2025-10138MedOct 22, 2025
    WordPress
    This Or That
    risk 0.42cvss 6.4epss 0.00

    The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2025-5983MedOct 22, 2025
    WordPress
    Meta Tag Manager
    risk 0.42cvss 6.5epss 0.00

    The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.

Page 312 of 805