VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,485 total · sorted by risk
  • CVE-2023-34003MedJun 9, 2024
    WooCommerce
    Box Office
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Woo WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.1.51.

  • CVE-2024-30534MedJun 9, 2024
    Typps
    Calendarista
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.5.

  • CVE-2023-52232MedJun 9, 2024
    WordPress
    Booster Plus For Woocommerce
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.

  • CVE-2023-52230MedJun 9, 2024
    WordPress
    Booster Plus For Woocommerce
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.3.

  • CVE-2024-35676MedJun 8, 2024
    Wp Ecommerce
    Recurring Paypal Donations
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations allows Stored XSS.This issue affects Recurring PayPal Donations: from n/a through 1.7.

  • CVE-2024-35675MedJun 8, 2024
    Advanced Woo Labels
    Advanced Woo Labels
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels allows Cross-Site Scripting (XSS).This issue affects Advanced Woo Labels: from n/a through 1.93.

  • CVE-2024-35705MedJun 8, 2024
    Getbutterfly
    Block For Font Awesome
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ciprian Popescu Block for Font Awesome allows Stored XSS.This issue affects Block for Font Awesome: from n/a through 1.4.4.

  • CVE-2024-35704MedJun 8, 2024
    Wpblockart
    Blockart Blocks
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPBlockArt BlockArt Blocks allows Stored XSS.This issue affects BlockArt Blocks: from n/a through 2.1.5.

  • CVE-2024-35703MedJun 8, 2024
    Sinaextra
    Sina Extension For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SinaExtra Sina Extension for Elementor allows Stored XSS.This issue affects Sina Extension for Elementor: from n/a through 3.5.3.

  • CVE-2024-35702MedJun 8, 2024
    Master Addons
    Master Addons
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.6.0.

  • CVE-2024-35701MedJun 8, 2024
    Propertyhive
    PropertyHive
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.13.

  • CVE-2024-35699MedJun 8, 2024
    Hasthemes
    Ht Feed
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes HT Feed allows Stored XSS.This issue affects HT Feed: from n/a through 1.2.8.

  • CVE-2024-35695MedJun 8, 2024
    Fahadmahmood
    Wp Docs
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Stored XSS.This issue affects WP Docs: from n/a through 2.1.3.

  • CVE-2024-35691MedJun 8, 2024
    WordPress
    Extended Widget Options
    risk 0.42cvss 6.5epss 0.00

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0.

  • CVE-2024-35688MedJun 8, 2024
    Master Addons
    Master Addons
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.5.9.

  • CVE-2024-35681MedJun 8, 2024
    Gvectors
    Wpdiscuz
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in gVectors Team wpDiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.18.

  • CVE-2024-34765MedJun 8, 2024
    WordPress
    Sensei Pro (WC Paid Courses)
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sensei Sensei Pro (WC Paid Courses) allows Stored XSS.This issue affects Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.

  • CVE-2024-35719MedJun 8, 2024
    Magnigenie
    Restropress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagniGenie RestroPress allows Stored XSS.This issue affects RestroPress: from n/a through 3.1.2.1.

  • CVE-2024-35715MedJun 8, 2024
    Peregrinethemes
    Bloglo
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in peregrinethemes Bloglo, peregrinethemes Blogvi allows Stored XSS.This issue affects Bloglo: from n/a through 1.1.3; Blogvi: from n/a through 1.0.5.

  • CVE-2024-35714MedJun 8, 2024
    Themefreesia
    Idyllic
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Idyllic allows Stored XSS.This issue affects Idyllic: from n/a through 1.1.8.

  • CVE-2024-35713MedJun 8, 2024
    Uapp
    Testimonial Carousel For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UAPP GROUP Testimonial Carousel For Elementor allows Stored XSS.This issue affects Testimonial Carousel For Elementor: from n/a through 10.1.1.

  • CVE-2024-35711MedJun 8, 2024
    Themefreesia
    Event
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Event allows Stored XSS.This issue affects Event: from n/a through 1.2.2.

  • CVE-2024-35709MedJun 8, 2024
    Posimyth
    The Plus Addons For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a…

  • CVE-2024-35708MedJun 8, 2024
    Apollo13themes
    Rife Free
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in apollo13themes Rife Free allows Stored XSS.This issue affects Rife Free: from n/a through 2.4.19.

  • CVE-2024-35707MedJun 8, 2024
    Heateor
    Social Login
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Stored XSS.This issue affects Heateor Social Login: from n/a through 1.1.32.

  • CVE-2024-35751MedJun 8, 2024
    Will Bontrager Software, LLC
    Woody ad snippets
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10.

  • CVE-2024-35740MedJun 8, 2024
    Themefreesia
    Pixgraphy
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Pixgraphy allows Stored XSS.This issue affects Pixgraphy: from n/a through 1.3.8.

  • CVE-2024-35739MedJun 8, 2024
    Radiustheme
    The Post Grid
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.1.

  • CVE-2024-35738MedJun 8, 2024
    WordPress
    Kognetiks Chatbot for WordPress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kognetiks Kognetiks Chatbot for WordPress allows Stored XSS.This issue affects Kognetiks Chatbot for WordPress: from n/a through 1.9.8.

  • CVE-2024-35731MedJun 8, 2024
    WordPress
    Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Moose Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor allows Stored XSS.This issue affects Kenta Gutenberg Blocks Responsive…

  • CVE-2024-35755MedJun 8, 2024
    El Tiempo
    Weather Widget Pro
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in El tiempo Weather Widget Pro allows Stored XSS.This issue affects Weather Widget Pro: from n/a through 1.1.40.

  • CVE-2024-35753MedJun 8, 2024
    Templatesnext
    Onepager
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TemplatesNext TemplatesNext OnePager allows Stored XSS.This issue affects TemplatesNext OnePager: from n/a through 1.3.3.

  • CVE-2024-5654MedJun 8, 2024
    WordPress
    Cf7 Google Sheets Connector
    risk 0.42cvss 6.5epss 0.00

    The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated…

  • CVE-2024-5663MedJun 8, 2024
    WordPress
    Cards for Beaver Builder
    risk 0.42cvss 6.4epss 0.00

    The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Cards widget in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-5599HigJun 7, 2024
    Fileorganizer
    Fileorganizer
    risk 0.42cvss 7.5epss 0.01

    The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to…

  • CVE-2024-5637HigJun 7, 2024
    WordPress
    Market Exporter
    risk 0.42cvss 7.5epss 0.01

    The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and…

  • CVE-2024-5612MedJun 7, 2024
    WordPress
    Essential Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_lightbox_open_btn_icon’ parameter within the Lightbox & Modal widget in all versions up to, and including, 5.8.15 due to insufficient input sanitization and…

  • CVE-2024-4887HigJun 7, 2024
    WordPress
    Qi Addons For Elementor
    risk 0.42cvss 7.5epss 0.01

    The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possible for authenticated attackers, with…

  • CVE-2024-36082MedJun 7, 2024
    WordPress
    Music Store
    risk 0.42cvss 6.5epss 0.01

    SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Information stored in the database may be obtained or altered by the attacker.

  • CVE-2024-1768MedJun 7, 2024
    WordPress
    Clever Fox
    risk 0.42cvss 6.4epss 0.00

    The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and including, 25.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2024-5221MedJun 6, 2024
    WordPress
    Qi Blocks
    risk 0.42cvss 6.4epss 0.00

    The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-5162MedJun 6, 2024
    WordPress
    Prettyphoto
    risk 0.42cvss 6.4epss 0.00

    The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2024-5161MedJun 6, 2024
    WordPress
    Magical Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 1.1.39 due to insufficient input…

  • CVE-2024-5141MedJun 6, 2024
    WordPress
    Rotating Tweets
    risk 0.42cvss 6.4epss 0.00

    The Rotating Tweets (Twitter widget and shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's' 'rotatingtweets' in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2024-4707MedJun 6, 2024
    WordPress
    Materialis Companion
    risk 0.42cvss 6.4epss 0.00

    The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2024-4608MedJun 6, 2024
    WordPress
    Sellkit
    risk 0.42cvss 6.4epss 0.00

    The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output…

  • CVE-2024-4459MedJun 6, 2024
    Themesflat
    Themesflat Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2024-4458MedJun 6, 2024
    Themesflat
    Themesflat Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-4364MedJun 6, 2024
    WordPress
    Qi Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-4212MedJun 6, 2024
    Themesflat
    Themesflat Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TF Group Image, TF Nav Menu, TF Posts, TF Woo Product Grid, TF Accordion, and TF Image Box widgets in all versions up to, and including, 2.1.1 due to…

Page 376 of 810