VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,549 total · sorted by risk
  • CVE-2024-2129MedMar 20, 2024
    Wpbits
    Wpbits Addons For Elementor Page Builder
    risk 0.42cvss 6.4epss 0.00

    The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2024-2474MedMar 20, 2024
    WordPress
    Standout Color Boxes And Buttons
    risk 0.42cvss 6.4epss 0.00

    The Standout Color Boxes and Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'color-button' shortcode in all versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes.…

  • CVE-2024-2124MedMar 20, 2024
    WordPress
    Weglot
    risk 0.42cvss 6.4epss 0.01

    The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2024-2460MedMar 20, 2024
    Gamipress
    Gamipress
    risk 0.42cvss 6.4epss 0.00

    The GamiPress – Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_button' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2024-1787MedMar 20, 2024
    WordPress
    Contests From Rewards Fuel
    risk 0.42cvss 6.4epss 0.01

    The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_rewards_fuel_api_key' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-29089MedMar 19, 2024
    WordPress
    Five Star Restaurant Menu
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Menu allows Stored XSS.This issue affects Five Star Restaurant Menu: from n/a through 2.4.14.

  • CVE-2024-29108MedMar 19, 2024
    Leevio
    Happy Addons For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leevio Happy Addons for Elementor allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.10.1.

  • CVE-2024-29107MedMar 19, 2024
    Webtechstreet
    Elementor Addon Elements
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.12.10.

  • CVE-2024-29106MedMar 19, 2024
    Leap13
    Premium Addons For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.10.16.

  • CVE-2024-29104MedMar 19, 2024
    Zimma Ltd.
    Ticket Tailor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zimma Ltd. Ticket Tailor allows Stored XSS.This issue affects Ticket Tailor: from n/a through 1.10.

  • CVE-2024-29101MedMar 19, 2024
    Jegtheme
    Jeg Elementor Kit
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue affects Jeg Elementor Kit: from n/a through 2.6.2.

  • CVE-2024-29098MedMar 19, 2024
    WordPress
    Wp Calameo
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calameo WP Calameo allows Stored XSS.This issue affects WP Calameo: from n/a through 2.1.7.

  • CVE-2024-29096MedMar 19, 2024
    WordPress
    Mjm Clinic
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Manning MJM Clinic.This issue affects MJM Clinic: from n/a through 1.1.22.

  • CVE-2024-29122MedMar 19, 2024
    Foliovision
    Fv Flowplayer Video Player
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.

  • CVE-2024-29118MedMar 19, 2024
    WordPress
    Scrollsequence
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scrollsequence allows Stored XSS.This issue affects Scrollsequence: from n/a through 1.5.4.

  • CVE-2024-29115MedMar 19, 2024
    Zaytech
    Smart Online Order For Clover
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Online Order for Clover allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a through 1.5.5.

  • CVE-2024-29114MedMar 19, 2024
    WordPress
    Download Manager
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84.

  • CVE-2024-29111MedMar 19, 2024
    WordPress
    Sitekit
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webvitaly Sitekit allows Stored XSS.This issue affects Sitekit: from n/a through 1.6.

  • CVE-2024-29109MedMar 19, 2024
    Datenverwurstungszentrale
    Shariff Wrapper
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jan-Peter Lambeck & 3UU Shariff Wrapper allows Stored XSS.This issue affects Shariff Wrapper: from n/a through 4.6.10.

  • CVE-2024-29134MedMar 19, 2024
    Themefic
    Tourfic
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8.

  • CVE-2024-29143MedMar 19, 2024
    Cozmoslabs
    Passwordless Login
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs, sareiodata Passwordless Login passwordless-login allows Stored XSS.This issue affects Passwordless Login: from n/a through 1.1.2.

  • CVE-2024-0365MedMar 18, 2024
    WordPress
    Fancy Product Designer
    risk 0.42cvss 6.5epss 0.01

    The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.

  • CVE-2023-6821MedMar 18, 2024
    Bestwebsoft
    Error Log Viewer
    risk 0.42cvss 6.5epss 0.01

    The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and download PHP logs without authorization

  • CVE-2024-23523MedMar 16, 2024
    WordPress
    Elementor Pro
    risk 0.42cvss 6.5epss 0.01

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Elementor Pro.This issue affects Elementor Pro: from n/a through 3.19.2.

  • CVE-2024-2042MedMar 16, 2024
    Wpmet
    Elementskit Elementor Addons
    risk 0.42cvss 6.4epss 0.00

    The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2024-1239MedMar 16, 2024
    WordPress
    ElementsKit Elementor addons
    risk 0.42cvss 6.4epss 0.00

    The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2024-2308MedMar 16, 2024
    Elementinvader
    Elementinvader Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link in the EliSlider in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-25593MedMar 15, 2024
    WordPress
    NEX-Forms
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.5.

  • CVE-2024-27189MedMar 15, 2024
    Catchsquare
    Wp Social Widget
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS.This issue affects WP Social Widget: from n/a through 2.2.5.

  • CVE-2024-25936MedMar 15, 2024
    Soundcloud
    Soundcloud Shortcode
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoundCloud Inc., Lawrie Malen SoundCloud Shortcode allows Stored XSS.This issue affects SoundCloud Shortcode: from n/a through 4.0.1.

  • CVE-2024-25934MedMar 15, 2024
    Formfacade
    Formfacade
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormFacade allows Stored XSS.This issue affects FormFacade: from n/a through 1.0.0.

  • CVE-2024-25919MedMar 15, 2024
    WordPress
    Custom Field Template
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.

  • CVE-2024-25916MedMar 15, 2024
    WordPress
    My Calendar
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joseph C Dolson My Calendar allows Stored XSS.This issue affects My Calendar: from n/a through 3.4.23.

  • CVE-2024-25598MedMar 15, 2024
    Livemeshelementor
    Addons For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through 8.3.

  • CVE-2024-1796MedMar 15, 2024
    WordPress
    Husky Products Filter Professional For Woocommerce
    risk 0.42cvss 6.4epss 0.00

    The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user…

  • CVE-2024-2256MedMar 14, 2024
    WordPress
    Oik
    risk 0.42cvss 6.4epss 0.00

    The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_button shortcodes in all versions up to, and including, 4.10.0 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2024-27986MedMar 14, 2024
    WordPress
    Elementor Addons by Livemesh
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Elementor Addons by Livemesh allows Stored XSS.This issue affects Elementor Addons by Livemesh: from n/a through 8.3.5.

  • CVE-2024-2079MedMar 13, 2024
    Livemeshthemes
    Wpbakery Page Builder Addons
    risk 0.42cvss 6.4epss 0.00

    The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mobile' shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2024-2293MedMar 13, 2024
    WordPress
    Site Reviews
    risk 0.42cvss 6.4epss 0.01

    The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-2286MedMar 13, 2024
    WordPress
    Sky Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link URL value in all versions up to, and including, 2.4.0 due to…

  • CVE-2024-25099MedMar 13, 2024
    Paytiumsupport
    Paytium
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment forms & donations allows Stored XSS.This issue affects Paytium: Mollie payment forms & donations: from n/a through 4.4.2.

  • CVE-2024-25097MedMar 13, 2024
    Themencode
    Tnc PDF Viewer
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 2.8.0.

  • CVE-2024-1997MedMar 13, 2024
    WordPress
    Premium Addons PRO
    risk 0.42cvss 6.4epss 0.00

    The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Messenger Chat Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it…

  • CVE-2024-1996MedMar 13, 2024
    WordPress
    Premium Addons PRO
    risk 0.42cvss 6.4epss 0.00

    The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-1894MedMar 13, 2024
    Burst Statistics
    Burst Statistics
    risk 0.42cvss 6.4epss 0.01

    The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'burst_total_pageviews_count' custom meta field in all versions up to, and including, 1.5.6.1 due to insufficient input sanitization and…

  • CVE-2024-1854MedMar 13, 2024
    WordPress
    Essential Blocks
    risk 0.42cvss 6.4epss 0.00

    The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This…

  • CVE-2024-1806MedMar 13, 2024
    WordPress
    Profilepress
    risk 0.42cvss 6.4epss 0.01

    The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.15.1 due to…

  • CVE-2024-1763MedMar 13, 2024
    WordPress
    Wp Social Login And Register Social Counter
    risk 0.42cvss 6.5epss 0.00

    The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp_social/v1/ REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for…

  • CVE-2024-1723MedMar 13, 2024
    Siteorigin
    Siteorigin Widgets Bundle
    risk 0.42cvss 6.4epss 0.01

    The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.58.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2024-1684MedMar 13, 2024
    WordPress
    Otter Blocks
    risk 0.42cvss 6.4epss 0.00

    The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact form file field CSS metabox in all versions up to, and including, 2.6.3 due to insufficient input sanitization and…

Page 389 of 811