VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,549 total · sorted by risk
  • CVE-2024-32556MedApr 18, 2024
    WordPress
    Hurrytimer
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer allows Stored XSS.This issue affects HurryTimer: from n/a through 2.9.2.

  • CVE-2024-32554MedApr 18, 2024
    Knight Lab
    Knight Lab Timeline
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Knight Lab Knight Lab Timeline allows Stored XSS.This issue affects Knight Lab Timeline: from n/a through 3.9.3.4.

  • CVE-2024-32596MedApr 18, 2024
    WordPress
    Dsgvo Youtube
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric-Oliver Mächler DSGVO Youtube allows Stored XSS.This issue affects DSGVO Youtube: from n/a through 1.4.5.

  • CVE-2024-32594MedApr 18, 2024
    WordPress
    Attesa Extra
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AttesaWP Attesa Extra allows Stored XSS.This issue affects Attesa Extra: from n/a through 1.3.9.

  • CVE-2024-32593MedApr 18, 2024
    Wpbits
    Wpbits Addons For Elementor Page Builder
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBits WPBITS Addons For Elementor Page Builder allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through 1.3.4.2.

  • CVE-2024-32592MedApr 18, 2024
    WordPress
    Void Elementor Whmcs Elements
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VoidCoders, innovs Void Elementor WHMCS Elements For Elementor Page Builder allows Stored XSS.This issue affects Void Elementor WHMCS Elements For Elementor Page Builder: from…

  • CVE-2024-32590MedApr 18, 2024
    WordPress
    Kattene
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webfood Kattene allows Stored XSS.This issue affects Kattene: from n/a through 1.7.

  • CVE-2022-41698MedApr 17, 2024
    WordPress
    If Menu
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Layered If Menu.This issue affects If Menu: from n/a through 0.16.3.

  • CVE-2024-32530MedApr 17, 2024
    WordPress
    Simple Testimonials Showcase
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through 1.1.5.

  • CVE-2024-32529MedApr 17, 2024
    Momoyoga
    Yoga Schedule Momoyoga
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Momoyoga Yoga Schedule Momoyoga allows Stored XSS.This issue affects Yoga Schedule Momoyoga: from n/a through 2.7.0.

  • CVE-2024-32527MedApr 17, 2024
    WordPress
    Jotform Online Forms
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jotform Jotform Online Forms allows Stored XSS.This issue affects Jotform Online Forms: from n/a through 1.3.1.

  • CVE-2024-32526MedApr 17, 2024
    WordPress
    Easy Textillate
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flector Easy Textillate allows Stored XSS.This issue affects Easy Textillate: from n/a through 2.02.

  • CVE-2024-32508MedApr 17, 2024
    Detheme
    Dethemekit For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.0.2.

  • CVE-2024-32505MedApr 17, 2024
    Wpmet
    Elementskit Elementor Addons
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.0.6.

  • CVE-2024-32457MedApr 17, 2024
    WordPress
    Elements Plus
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The CSSIgniter Team Elements Plus! allows Stored XSS.This issue affects Elements Plus!: from n/a through 2.16.3.

  • CVE-2024-32456MedApr 17, 2024
    Envothemes
    Envo Extra
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra allows Stored XSS.This issue affects Envo Extra: from n/a through 1.8.11.

  • CVE-2024-32130MedApr 17, 2024
    WordPress
    Payment Forms For Paystack
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paystack Payment Forms for Paystack allows Stored XSS.This issue affects Payment Forms for Paystack: from n/a through 3.4.1.

  • CVE-2024-32539MedApr 17, 2024
    WordPress
    Wp File Download Light
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP File Download Light allows Stored XSS.This issue affects WP File Download Light: from n/a through 1.3.3.

  • CVE-2024-32538MedApr 17, 2024
    WordPress
    Easy Countdowner
    risk 0.42cvss 6.5epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Joshua Eldridge Easy CountDowner allows Stored XSS.This issue affects Easy CountDowner: from n/a through 1.0.8.

  • CVE-2024-32536MedApr 17, 2024
    WordPress
    Wp Tradingview
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Trade Pips WP TradingView allows Stored XSS.This issue affects WP TradingView: from n/a through 1.7.

  • CVE-2024-32509MedApr 17, 2024
    WordPress
    Wp Cost Estimation Payment Forms Builder
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.76.

  • CVE-2024-3672MedApr 16, 2024
    WordPress
    Ba Book Everything
    risk 0.42cvss 6.4epss 0.00

    The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'.…

  • CVE-2024-1357MedApr 16, 2024
    WordPress
    Shortcodes And Extra Features For Phlox
    risk 0.42cvss 6.4epss 0.00

    The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2024-32557MedApr 16, 2024
    Exclusiveaddons
    Exclusive Addons For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.2.

  • CVE-2024-32091MedApr 15, 2024
    WordPress
    Sangar Slider
    risk 0.42cvss 6.5epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Tonjoo Sangar Slider.This issue affects Sangar Slider: from n/a through 1.3.2.

  • CVE-2024-32147MedApr 15, 2024
    Ghozylab
    Contact Form
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through 1.1.23.

  • CVE-2024-32140MedApr 15, 2024
    Libsyn
    Libsyn Publisher Hub
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in libsyn Libsyn Publisher Hub libsyn-podcasting.This issue affects Libsyn Publisher Hub: from n/a through <= 1.4.4.

  • CVE-2024-32079MedApr 15, 2024
    Michael Dempfle
    Advanced iFrame
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2024.2.

  • CVE-2024-1307MedApr 15, 2024
    WordPress
    Smart Forms
    risk 0.42cvss 6.5epss 0.01

    The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions

  • CVE-2023-7201MedApr 15, 2024
    WordPress
    Everest Backup
    risk 0.42cvss 6.5epss 0.01

    The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

  • CVE-2024-3027MedApr 13, 2024
    WordPress
    Smart Slider 3
    risk 0.42cvss 6.4epss 0.00

    The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access…

  • CVE-2024-2801MedApr 12, 2024
    WordPress
    Shopkeeper Extender
    risk 0.42cvss 6.4epss 0.00

    The Shopkeeper Extender plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'image_slide' shortcode in all versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-2137MedApr 12, 2024
    WordPress
    All In One Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Single, Pricing Icon, Pricing Tab) in all versions up to, and including, 2.5.1 due to insufficient input sanitization…

  • CVE-2024-27991MedApr 11, 2024
    WordPress
    Supportcandy
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SupportCandy allows Stored XSS.This issue affects SupportCandy: from n/a through 3.2.3.

  • CVE-2024-27990MedApr 11, 2024
    WordPress
    The Moneytizer
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20.

  • CVE-2024-27989MedApr 11, 2024
    WordPress
    Responsive Horizontal Vertical And Accordion Tabs
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs allows Stored XSS.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs:…

  • CVE-2024-27988MedApr 11, 2024
    WordPress
    Wen Responsive Columns
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2.

  • CVE-2024-27969MedApr 11, 2024
    WordPress
    Free Downloads WooCommerce
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Enhanced Free Downloads WooCommerce allows Stored XSS.This issue affects Free Downloads WooCommerce: from n/a through 3.5.8.2.

  • CVE-2022-44633MedApr 11, 2024
    WordPress
    YITH WooCommerce Gift Cards premium
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.

  • CVE-2024-31342MedApr 10, 2024
    WordPress
    WordPress Gallery Exporter
    risk 0.42cvss 6.5epss 0.01

    Missing Authorization vulnerability in WPcloudgallery WordPress Gallery Exporter.This issue affects WordPress Gallery Exporter: from n/a through 1.3.

  • CVE-2024-31287MedApr 10, 2024
    Maxfoundry
    Media Library Folders
    risk 0.42cvss 6.5epss 0.01

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8.

  • CVE-2024-2655MedApr 10, 2024
    WordPress
    Elementor Addons by Livemesh
    risk 0.42cvss 6.4epss 0.00

    The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all versions up to, and including, 8.3.5 due to insufficient input sanitization and output escaping on author display names. This makes it possible…

  • CVE-2024-2734MedApr 10, 2024
    WordPress
    Bold Page Builder
    risk 0.42cvss 6.4epss 0.01

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2024-1042MedApr 10, 2024
    Wpmilitary
    Wp Radio
    risk 0.42cvss 6.4epss 0.00

    The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 3.1.9. This makes it possible for…

  • CVE-2024-1041MedApr 10, 2024
    Wpmilitary
    Wp Radio
    risk 0.42cvss 6.4epss 0.00

    The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping as well as…

  • CVE-2024-2665MedApr 10, 2024
    WordPress
    Premium Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button in all versions up to, and including, 4.10.27 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-2664MedApr 10, 2024
    WordPress
    Premium Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Widget in all versions up to, and including, 4.10.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2024-3208MedApr 9, 2024
    WordPress
    Sydney Toolbox
    risk 0.42cvss 6.4epss 0.00

    The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 1.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-3167MedApr 9, 2024
    WordPress
    Ocean Extra
    risk 0.42cvss 6.4epss 0.01

    The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-3064MedApr 9, 2024
    WordPress
    Stax Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heading' widgets in all versions up to, and including, 1.4.4.1 due to insufficient input sanitization and output escaping on user supplied…

Page 384 of 811