VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,358 total · sorted by risk
  • CVE-2024-53747MedDec 1, 2024
    WordPress
    Video Player For Wpbakery
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nutttaro Video Player for WPBakery video-player-for-wpbakery allows Stored XSS.This issue affects Video Player for WPBakery: from n/a through <= 1.0.1.

  • CVE-2024-53746MedDec 1, 2024
    WordPress
    Elementor Button Plus
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs Elementor Button Plus fd-elementor-button-plus allows Stored XSS.This issue affects Elementor Button Plus: from n/a through <= 1.3.9.

  • CVE-2024-53745MedDec 1, 2024
    WordPress
    Cosmosfarm Share Buttons
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 코스모스팜 – Cosmosfarm 소셜 공유 버튼 By 코스모스팜 cosmosfarm-share-buttons allows Stored XSS.This issue affects 소셜 공유 버튼 By 코스모스팜:…

  • CVE-2024-53744MedDec 1, 2024
    WordPress
    Elementor Image Gallery Plugin
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SkyBootstrap Elementor Image Gallery Plugin skyboot-portfolio-gallery allows Stored XSS.This issue affects Elementor Image Gallery Plugin: from n/a through <= 1.0.5.

  • CVE-2024-53743MedDec 1, 2024
    WordPress
    Countdown Timer For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh Countdown Timer for Elementor countdown-timer-for-elementor allows Stored XSS.This issue affects Countdown Timer for Elementor: from n/a through <= 1.3.6.

  • CVE-2024-53786MedNov 30, 2024
    Codeless
    Cowidgets Elementor Addons
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeless Cowidgets – Elementor Addons cowidgets-elementor-addons allows Stored XSS.This issue affects Cowidgets – Elementor Addons: from n/a through <= 1.2.0.

  • CVE-2024-53774MedNov 30, 2024
    Jakub Glos
    Sparkle Elementor Kit
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows DOM-Based XSS.This issue affects Sparkle Elementor Kit: from n/a through <= 2.0.9.

  • CVE-2024-53773MedNov 30, 2024
    WordPress
    Znajdź Pracę z Praca.pl
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pracapl Znajdź Pracę z Praca.pl znajdz-prace-z-pracapl allows DOM-Based XSS.This issue affects Znajdź Pracę z Praca.pl: from n/a through <= 2.2.3.

  • CVE-2024-53772MedNov 30, 2024
    WordPress
    Mail Picker
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Mail Picker mail-picker allows DOM-Based XSS.This issue affects Mail Picker: from n/a through <= 1.0.15.

  • CVE-2024-53771MedNov 30, 2024
    WordPress
    SimpleSchema
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sergiomico SimpleSchema simpleschema-free allows DOM-Based XSS.This issue affects SimpleSchema: from n/a through <= 1.7.6.9.

  • CVE-2024-53767MedNov 30, 2024
    WordPress
    Pixobe Cartography
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixobe Pixobe Cartography pixobe-cartography allows DOM-Based XSS.This issue affects Pixobe Cartography: from n/a through <= 1.0.1.

  • CVE-2024-53766MedNov 30, 2024
    WordPress
    Devnex Addons For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devnex Devnex Addons For Elementor devnex-addons-for-elementor allows DOM-Based XSS.This issue affects Devnex Addons For Elementor: from n/a through <= 1.0.9.

  • CVE-2024-53764MedNov 30, 2024
    WordPress
    Softtemplates For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Softtemplates For Elementor softtemplates-for-elementor allows DOM-Based XSS.This issue affects Softtemplates For Elementor: from n/a through <= 1.0.8.

  • CVE-2024-53763MedNov 30, 2024
    WordPress
    Best Addons For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rejuan Ahamed Best Addons for Elementor allows Stored XSS.This issue affects Best Addons for Elementor: from n/a through 1.0.5.

  • CVE-2024-53760MedNov 30, 2024
    WordPress
    Capitalize My Title
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Capitalize My Title Capitalize My Title capitalize-my-title allows Stored XSS.This issue affects Capitalize My Title: from n/a through <= 0.5.3.

  • CVE-2024-53758MedNov 30, 2024
    WordPress
    WP MathJax
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP MathJax wp-mathjax-plus allows Stored XSS.This issue affects WP MathJax: from n/a through <= 1.0.1.

  • CVE-2024-53757MedNov 30, 2024
    WordPress
    Wp Find Your Nearest
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest allows Stored XSS.This issue affects WP Find Your Nearest: from n/a through <= 0.3.1.

  • CVE-2024-53756MedNov 30, 2024
    WordPress
    Vertical Carousel
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aftab Husain Vertical Carousel vertical-carousel-slider allows Stored XSS.This issue affects Vertical Carousel: from n/a through <= 1.0.2.

  • CVE-2024-53787MedNov 30, 2024
    WordPress
    Random Banner
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Random Banner random-banner allows Stored XSS.This issue affects Random Banner: from n/a through <= 4.2.12.

  • CVE-2024-53731MedNov 28, 2024
    WordPress
    Fintelligence Calculator
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fintelligence Fintelligence Calculator fintelligence-calculator allows Stored XSS.This issue affects Fintelligence Calculator: from n/a through <= 1.0.3.

  • CVE-2024-53737MedNov 28, 2024
    Wpmailster
    Wp Mailster
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through <= 1.8.16.0.

  • CVE-2024-8066HigNov 28, 2024
    WordPress
    File Manager Pro
    risk 0.42cvss 7.5epss 0.01

    The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access…

  • CVE-2024-11788MedNov 28, 2024
    WordPress
    Streamweasels Youtube Integration
    risk 0.42cvss 6.4epss 0.00

    The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-youtube-embed' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2024-11431MedNov 28, 2024
    WordPress
    Ragic Shortcode
    risk 0.42cvss 6.4epss 0.00

    The Ragic Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ragic' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2024-10895MedNov 27, 2024
    WordPress
    Counter Up
    risk 0.42cvss 6.4epss 0.00

    The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lgx-counter' shortcode in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on…

  • CVE-2024-10175MedNov 27, 2024
    WordPress
    Simple Pricing Tables For WPBakery Page Builder
    risk 0.42cvss 6.4epss 0.00

    The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wdo_pricing_tables shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output…

  • CVE-2024-8236MedNov 26, 2024
    Elementor
    Website Builder
    risk 0.42cvss 6.4epss 0.00

    The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output…

  • CVE-2024-11192MedNov 26, 2024
    WordPress
    Spotify Play Button For Wordpress
    risk 0.42cvss 6.4epss 0.00

    The Spotify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spotifyplaybutton shortcode in all versions up to, and including, 2.11 due to insufficient input sanitization and output escaping on user supplied attributes.…

  • CVE-2024-11426MedNov 23, 2024
    WordPress
    Autolisticle Automatically Update Numbered List Articles
    risk 0.42cvss 6.4epss 0.00

    The AutoListicle: Automatically Update Numbered List Articles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-list-number' shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on…

  • CVE-2024-11408MedNov 23, 2024
    WordPress
    Slotti Ajanvaraus
    risk 0.42cvss 6.4epss 0.00

    The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-11387MedNov 23, 2024
    WordPress
    Easy Liveblogs
    risk 0.42cvss 6.4epss 0.01

    The Easy Liveblogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elb_liveblog' shortcode in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-11332MedNov 23, 2024
    WordPress
    HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents
    risk 0.42cvss 6.4epss 0.00

    The HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hipaatizer' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization…

  • CVE-2024-10886MedNov 23, 2024
    WordPress
    Tribute Testimonials
    risk 0.42cvss 6.4epss 0.00

    The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testimonials_slider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output…

  • CVE-2024-10874MedNov 23, 2024
    WordPress
    Quotes Llama
    risk 0.42cvss 6.4epss 0.00

    The Quotes llama plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quotes-llama' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-10116MedNov 23, 2024
    Firecask
    Twitter Follow Button
    risk 0.42cvss 6.4epss 0.00

    The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-11381MedNov 22, 2024
    WordPress
    Control Horas
    risk 0.42cvss 6.4epss 0.01

    The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ch_registro' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-9851MedNov 21, 2024
    WordPress
    Lsx Tour Operator
    risk 0.42cvss 6.4epss 0.00

    The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-9442MedNov 21, 2024
    WordPress
    F4 Improvements
    risk 0.42cvss 6.4epss 0.00

    The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-9111MedNov 21, 2024
    WordPress
    Product Designer
    risk 0.42cvss 6.4epss 0.01

    The Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-11455MedNov 21, 2024
    WordPress
    Include Mastodon Feed
    risk 0.42cvss 6.4epss 0.00

    The Include Mastodon Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'include-mastodon-feed' shortcode in all versions up to, and including, 1.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2024-11438MedNov 21, 2024
    WordPress
    Online Status Bar
    risk 0.42cvss 6.4epss 0.00

    The StreamWeasels Online Status Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-status-bar' shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes.…

  • CVE-2024-11428MedNov 21, 2024
    WordPress
    Lazy Load Videos And Sticky Control
    risk 0.42cvss 6.4epss 0.01

    The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on…

  • CVE-2024-11424MedNov 21, 2024
    WordPress
    Slick Sitemap
    risk 0.42cvss 6.4epss 0.01

    The Slick Sitemap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slick-sitemap' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-11414MedNov 21, 2024
    WordPress
    Recipepress Reloaded
    risk 0.42cvss 6.4epss 0.00

    The RecipePress Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Ingredients in all versions up to, and including, 2.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-11412MedNov 21, 2024
    WordPress
    Shine PDF Embeder
    risk 0.42cvss 6.4epss 0.01

    The Shine PDF Embeder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shinepdf' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-11385MedNov 21, 2024
    WordPress
    Pure CSS Circle Progress bar
    risk 0.42cvss 6.4epss 0.00

    The Pure CSS Circle Progress bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'circle_progress' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2024-10785MedNov 21, 2024
    WordPress
    Gutenberg Blocks with AI by Kadence WP
    risk 0.42cvss 6.4epss 0.00

    The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it…

  • CVE-2024-10177MedNov 21, 2024
    WordPress
    Beds24 Online Booking
    risk 0.42cvss 6.4epss 0.01

    The Beds24 Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's beds24-link shortcode in all versions up to, and including, 2.0.27 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-10172MedNov 21, 2024
    WordPress
    WPBakery Visual Composer WHMCS Elements
    risk 0.42cvss 6.4epss 0.01

    The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's void_wbwhmcse_laouts_search shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user…

  • CVE-2024-11179MedNov 20, 2024
    WordPress
    Mstore API
    risk 0.42cvss 6.5epss 0.00

    The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient…

Page 356 of 808