VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,332 total · sorted by risk
  • CVE-2025-26947MedFeb 25, 2025
    WordPress
    Services Section Block
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows Stored XSS.This issue affects Services Section block: from n/a through <= 1.3.4.

  • CVE-2025-26945MedFeb 25, 2025
    WordPress
    Info Cards
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This issue affects Info Cards: from n/a through <= 1.0.5.

  • CVE-2025-26939MedFeb 25, 2025
    WordPress
    Counters Block
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block counters-block allows Stored XSS.This issue affects Counters Block: from n/a through <= 1.1.2.

  • CVE-2025-26938MedFeb 25, 2025
    WordPress
    Countdown Timer
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS.This issue affects Countdown Timer: from n/a through <= 1.2.6.

  • CVE-2025-26937MedFeb 25, 2025
    WordPress
    Icon List Block
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.

  • CVE-2025-26913MedFeb 25, 2025
    WordPress
    AR For Wordpress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress ar-for-wordpress allows DOM-Based XSS.This issue affects AR For WordPress: from n/a through <= 7.7.

  • CVE-2025-26912MedFeb 25, 2025
    WordPress
    Easy Elementor Addons
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.6.

  • CVE-2025-26904MedFeb 25, 2025
    WordPress
    WP Responsive Auto Fit Text
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gal_op WP Responsive Auto Fit Text wp-responsive-slab-text allows DOM-Based XSS.This issue affects WP Responsive Auto Fit Text: from n/a through <= 0.2.

  • CVE-2025-26897MedFeb 25, 2025
    WordPress
    List Related Attachments Widget
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baden List Related Attachments list-related-attachments-widget allows DOM-Based XSS.This issue affects List Related Attachments: from n/a through <= 2.1.6.

  • CVE-2025-26896MedFeb 25, 2025
    WordPress
    Piwigopress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vpiwigo PiwigoPress piwigopress allows Stored XSS.This issue affects PiwigoPress: from n/a through <= 2.33.

  • CVE-2025-26893MedFeb 25, 2025
    WordPress
    Easy Charts
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Potphode Easy Charts easy-charts allows DOM-Based XSS.This issue affects Easy Charts: from n/a through <= 1.2.3.

  • CVE-2025-26887MedFeb 25, 2025
    WordPress
    EZ SQL Reports Shortcode Widget and DB Backup
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.21.35.

  • CVE-2025-26884MedFeb 25, 2025
    Greenshiftwp
    Greenshift Animation And Page Builder Blocks
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 10.8.

  • CVE-2025-26882MedFeb 25, 2025
    WordPress
    Popup Builder
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Popup Builder easy-notify-lite allows Stored XSS.This issue affects Popup Builder: from n/a through <= 1.1.33.

  • CVE-2025-26881MedFeb 25, 2025
    WordPress
    Sticky Content
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.

  • CVE-2025-26877MedFeb 25, 2025
    Etoilewebdesign
    Front End Users
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.30.

  • CVE-2024-54444MedFeb 25, 2025
    Elementor
    Website Builder
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.25.10.

  • CVE-2024-13695MedFeb 25, 2025
    WordPress
    Enfold
    risk 0.42cvss 6.4epss 0.00

    The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to…

  • CVE-2025-27351MedFeb 24, 2025
    WordPress
    Local Search Seo Contact Page
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpertBusinessSearch Local Search SEO Contact Page local-search-seo-contact-page allows Stored XSS.This issue affects Local Search SEO Contact Page: from n/a through <= 4.0.1.

  • CVE-2025-27349MedFeb 24, 2025
    WordPress
    Get Posts
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nurelm Get Posts nurelm-get-posts allows Stored XSS.This issue affects Get Posts: from n/a through <= 0.6.

  • CVE-2025-27348MedFeb 24, 2025
    WordPress
    Wp Social Seo Booster
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Signals SEO wp-social-seo-booster allows Stored XSS.This issue affects WP Social SEO Booster – Knowledge Graph Social…

  • CVE-2025-27347MedFeb 24, 2025
    WordPress
    Direct Checkout Button for WooCommerce
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Direct Checkout Button for WooCommerce woo-direct-checkout-button allows Stored XSS.This issue affects Direct Checkout Button for WooCommerce: from n/a through <= 1.0.

  • CVE-2025-27341MedFeb 24, 2025
    WordPress
    Reactive Mortgage Calculator
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in afzal_du Reactive Mortgage Calculator reactive-mortgage-calculator allows Stored XSS.This issue affects Reactive Mortgage Calculator: from n/a through <= 1.1.

  • CVE-2025-27331MedFeb 24, 2025
    WordPress
    Woocommerce Display Products By Tags
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sébastien Dumont WooCommerce Display Products by Tags woocommerce-display-products-by-tags allows DOM-Based XSS.This issue affects WooCommerce Display Products by Tags: from…

  • CVE-2025-27330MedFeb 24, 2025
    PlayerJS
    PlayerJS
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issue affects PlayerJS: from n/a through <= 2.23.

  • CVE-2025-27329MedFeb 24, 2025
    WordPress
    EZ InLinkz linkup
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inlinkz EZ InLinkz linkup inlinkz-scripter allows DOM-Based XSS.This issue affects EZ InLinkz linkup: from n/a through <= 0.18.

  • CVE-2025-27327MedFeb 24, 2025
    WordPress
    Live Streaming Video Player – by SRS Player
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Winlin Live Streaming Video Player – by SRS Player srs-player allows DOM-Based XSS.This issue affects Live Streaming Video Player – by SRS Player: from n/a through <= 1.0.18.

  • CVE-2025-27325MedFeb 24, 2025
    WordPress
    Videojs Hls Player
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player videojs-hls-player allows DOM-Based XSS.This issue affects Video.js HLS Player: from n/a through <= 1.0.2.

  • CVE-2025-27323MedFeb 24, 2025
    WordPress
    Wp About Author
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jon Bishop WP About Author wp-about-author allows DOM-Based XSS.This issue affects WP About Author: from n/a through <= 1.5.

  • CVE-2025-27320MedFeb 24, 2025
    WordPress
    Profile Widget Ninja
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja allows DOM-Based XSS.This issue affects Profile Widget Ninja: from n/a through <= 4.3.

  • CVE-2025-27307MedFeb 24, 2025
    WordPress
    Quotes Llama
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows Reflected XSS.This issue affects Quotes llama: from n/a through <= 3.0.1.

  • CVE-2025-27306MedFeb 24, 2025
    Pathomation
    pathomation
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pathomation Pathomation pathomation allows Stored XSS.This issue affects Pathomation: from n/a through <= 2.5.1.

  • CVE-2025-27305MedFeb 24, 2025
    WordPress
    Table Of Contents
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Achal Jain Table of Contents Block table-of-contents allows Stored XSS.This issue affects Table of Contents Block: from n/a through <= 1.0.2.

  • CVE-2025-27280MedFeb 24, 2025
    WordPress
    Archive Page
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alobaidi Archive Page archive-page allows DOM-Based XSS.This issue affects Archive Page: from n/a through <= 1.0.2.

  • CVE-2025-27266MedFeb 24, 2025
    Ignacio Perez
    Hover Image Button
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignacio Perez Hover Image Button hover-image-button allows DOM-Based XSS.This issue affects Hover Image Button: from n/a through <= 1.1.2.

  • CVE-2025-27265MedFeb 24, 2025
    WordPress
    Google Maps For Wordpress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aaron D. Campbell Google Maps for WordPress google-maps-for-wordpress allows DOM-Based XSS.This issue affects Google Maps for WordPress: from n/a through <= 1.0.3.

  • CVE-2025-26883MedFeb 24, 2025
    WordPress
    Animated Text Block
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Text Block: from n/a through <= 1.0.7.

  • CVE-2025-26973MedFeb 22, 2025
    WordPress
    Social Warfare
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WarfarePlugins Social Warfare social-warfare allows DOM-Based XSS.This issue affects Social Warfare: from n/a through <= 4.5.5.

  • CVE-2025-26764MedFeb 22, 2025
    WordPress
    Distance Based Shipping Calculator
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through <=…

  • CVE-2025-26750MedFeb 22, 2025
    WordPress
    Vitepos Lite
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vitepos: from n/a through <= 3.1.3.

  • CVE-2025-1361HigFeb 22, 2025
    WordPress
    Ip2location Country Blocker
    risk 0.42cvss 7.5epss 0.01

    The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the…

  • CVE-2024-13455MedFeb 21, 2025
    igumbi
    Igumbi
    risk 0.42cvss 6.4epss 0.00

    The igumbi Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'igumbi_calendar' shortcode in all versions up to, and including, 1.40 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2024-13648MedFeb 21, 2025
    WordPress
    Maps For Wp
    risk 0.42cvss 6.4epss 0.00

    The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-13461MedFeb 21, 2025
    WordPress
    Autoship Cloud For Woocommerce Subscription Products
    risk 0.42cvss 6.4epss 0.00

    The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and…

  • CVE-2024-12452MedFeb 21, 2025
    WordPress
    Ziggeo
    risk 0.42cvss 6.4epss 0.00

    The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeo_event' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2025-1407MedFeb 21, 2025
    Amothemo
    Amo Team Showcase
    risk 0.42cvss 6.4epss 0.00

    The AMO Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's amoteam_skills shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2025-1406MedFeb 21, 2025
    WordPress
    Newpost Catch
    risk 0.42cvss 6.4epss 0.00

    The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, and including, 1.3.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2024-13751MedFeb 21, 2025
    WordPress
    3D Photo Gallery
    risk 0.42cvss 6.4epss 0.00

    The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des[]' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-13672MedFeb 21, 2025
    WordPress
    Mini Course Generator
    risk 0.42cvss 6.4epss 0.00

    The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on…

  • CVE-2024-13388MedFeb 21, 2025
    WordPress
    TCBD Tooltip
    risk 0.42cvss 6.4epss 0.00

    The TCBD Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbdtooltip_text' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

Page 340 of 807