VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,549 total · sorted by risk
  • CVE-2024-24880MedFeb 8, 2024
    Apollo13themes
    Apollo13 Framework Extensions
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2.

  • CVE-2023-5665MedFeb 8, 2024
    Paystack
    Payment Forms For Paystack
    risk 0.42cvss 6.4epss 0.01

    The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-0961MedFeb 5, 2024
    Siteorigin
    Siteorigin Widgets Bundle
    risk 0.42cvss 6.4epss 0.01

    The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to, and including, 1.58.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2024-0834MedFeb 5, 2024
    WordPress
    Elementor Addon Elements
    risk 0.42cvss 6.4epss 0.01

    The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up to, and including, 1.12.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2024-0678MedFeb 5, 2024
    WordPress
    Order Delivery Date for WP e-Commerce
    risk 0.42cvss 6.5epss 0.00

    The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-0508MedFeb 5, 2024
    WordPress
    Orbit Fox
    risk 0.42cvss 6.4epss 0.01

    The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table Elementor Widget in all versions up to, and including, 2.10.27 due to insufficient input sanitization and output escaping on the user supplied link URL.…

  • CVE-2024-0448MedFeb 5, 2024
    WordPress
    Elementor Addons by Livemesh
    risk 0.42cvss 6.4epss 0.01

    The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget URL parameters in all versions up to, and including, 8.3.1 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-0384MedFeb 5, 2024
    WordPress
    Wp Recipe Maker
    risk 0.42cvss 6.4epss 0.01

    The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Notes in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with…

  • CVE-2024-0254MedFeb 5, 2024
    WordPress
    (Simply) Guest Author Name
    risk 0.42cvss 6.4epss 0.01

    The (Simply) Guest Author Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post meta in all versions up to, and including, 4.34 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2023-6982MedFeb 5, 2024
    WordPress
    Display custom fields in the frontend
    risk 0.42cvss 6.4epss 0.00

    The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and postmeta in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output…

  • CVE-2023-6884MedFeb 5, 2024
    WordPress
    widget-google-reviews
    risk 0.42cvss 6.4epss 0.01

    This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'place_id' attribute. This makes it possible for authenticated attackers…

  • CVE-2023-6807MedFeb 5, 2024
    Generatepress
    Generatepress
    risk 0.42cvss 6.4epss 0.00

    The GeneratePress Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom meta output in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2023-6526MedFeb 5, 2024
    WordPress
    Meta Box
    risk 0.42cvss 6.4epss 0.00

    The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output…

  • CVE-2024-24865MedFeb 5, 2024
    Noahkagan
    Scroll Triggered Box
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan Scroll Triggered Box allows Stored XSS.This issue affects Scroll Triggered Box: from n/a through 2.3.

  • CVE-2024-24839MedFeb 5, 2024
    Wpsc Plugin
    Structured Content
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.6.1.

  • CVE-2024-24838MedFeb 5, 2024
    WordPress
    Five Star Restaurant Reviews
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Reviews allows Stored XSS.This issue affects Five Star Restaurant Reviews: from n/a through 2.3.5.

  • CVE-2024-24870MedFeb 5, 2024
    Michael Dempfle
    Advanced iFrame
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.10.

  • CVE-2023-51504MedFeb 5, 2024
    WordPress
    Dan's Embedder for Google Calendar
    risk 0.42cvss 6.5epss 0.01

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Dulaney Dan's Embedder for Google Calendar allows Stored XSS.This issue affects Dan's Embedder for Google Calendar: from n/a through 1.2.

  • CVE-2024-1073MedFeb 2, 2024
    WordPress
    Slimstat Analytics
    risk 0.42cvss 6.4epss 0.00

    The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2023-51520MedFeb 1, 2024
    Wpdevart
    Booking Calendar
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XSS.This issue affects WP Booking Calendar: from n/a before 9.7.4.

  • CVE-2023-51514MedFeb 1, 2024
    Codeboxr
    Cbx Bookmark \& Favorite
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr Team CBX Bookmark & Favorite allows Stored XSS.This issue affects CBX Bookmark & Favorite: from n/a through 1.7.13.

  • CVE-2023-52118MedFeb 1, 2024
    Wp Eventmanager
    Wp Event Manager
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0.

  • CVE-2023-51694MedFeb 1, 2024
    Epiphyt
    Embed Privacy
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affects Embed Privacy: from n/a through 1.8.0.

  • CVE-2023-51693MedFeb 1, 2024
    Themify
    Icons
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects Themify Icons: from n/a through 2.0.1.

  • CVE-2023-51690MedFeb 1, 2024
    Advanced IFrame
    Advanced iFrame
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.8.

  • CVE-2023-51689MedFeb 1, 2024
    Noorsplugin
    Easy Video Player
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue affects Easy Video Player: from n/a through 1.2.2.10.

  • CVE-2023-51684MedFeb 1, 2024
    Awesomemotive
    Easy Digital Downloads
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads – Sell…

  • CVE-2023-51674MedFeb 1, 2024
    Vasyltech
    Advanced Access Manager
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted…

  • CVE-2023-51669MedFeb 1, 2024
    Artiosmedia
    Product Code For Woocommerce
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artios Media Product Code for WooCommerce allows Stored XSS.This issue affects Product Code for WooCommerce: from n/a through 1.4.4.

  • CVE-2023-51666MedFeb 1, 2024
    Pickplugins
    Related Post
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue affects Related Post: from n/a through 2.0.53.

  • CVE-2023-51532MedFeb 1, 2024
    Icegram
    Icegram Engage
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored XSS.This issue affects Icegram Engage – WordPress Lead…

  • CVE-2023-52195MedFeb 1, 2024
    Kerryjames
    Posts To Page
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Posts to Page Kerry James allows Stored XSS.This issue affects Kerry James: from n/a through 1.7.

  • CVE-2023-52194MedFeb 1, 2024
    Takayukimiyauchi
    Oembed Gist
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takayuki Miyauchi oEmbed Gist allows Stored XSS.This issue affects oEmbed Gist: from n/a through 4.9.1.

  • CVE-2023-52193MedFeb 1, 2024
    Blueastral
    Page Builder\
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 1.5.23.

  • CVE-2023-52192MedFeb 1, 2024
    WordPress
    Keap Official Opt-in Forms
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 1.0.11.

  • CVE-2023-52191MedFeb 1, 2024
    Torbjon
    Infogram
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Torbjon Infogram – Add charts, maps and infographics allows Stored XSS.This issue affects Infogram – Add charts, maps and infographics: from n/a through 1.6.1.

  • CVE-2023-52189MedFeb 1, 2024
    Jhayghost
    Ideal Interactive Map
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhayghost Ideal Interactive Map allows Stored XSS.This issue affects Ideal Interactive Map: from n/a through 1.2.4.

  • CVE-2023-52188MedFeb 1, 2024
    Russelljamieson
    Footer Putter
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter allows Stored XSS.This issue affects Footer Putter: from n/a through 1.17.

  • CVE-2023-7069MedFeb 1, 2024
    WordPress
    Advanced Iframe
    risk 0.42cvss 6.4epss 0.00

    The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2023.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-22150MedJan 31, 2024
    WordPress
    Portfolio & Image Gallery for WordPress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery for WordPress | PowerFolio allows Stored XSS.This issue affects Portfolio & Image Gallery for WordPress | PowerFolio: from n/a through 3.1.

  • CVE-2024-22297MedJan 31, 2024
    Codeboxr
    Cbx Map
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap allows Stored XSS.This issue affects CBX Map for Google Map & OpenStreetMap: from n/a through 1.1.11.

  • CVE-2024-22292MedJan 31, 2024
    Delower
    Wp To Do
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.2.8.

  • CVE-2024-22310MedJan 31, 2024
    Formzu
    Formzu Wp
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formzu Inc. Formzu WP allows Stored XSS.This issue affects Formzu WP: from n/a through 1.6.7.

  • CVE-2024-22302MedJan 31, 2024
    Albo Pretorio On Line Project
    Albo Pretorio On line
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignazio Scimone Albo Pretorio On line allows Stored XSS.This issue affects Albo Pretorio On line: from n/a through 4.6.6.

  • CVE-2024-23505MedJan 31, 2024
    Dearhive
    Dearpdf
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF allows Stored XSS.This issue affects PDF Viewer & 3D PDF Flipbook – DearPDF: from n/a through 2.0.38.

  • CVE-2024-23502MedJan 31, 2024
    Infornweb
    Posts List Designer By Category
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in InfornWeb Posts List Designer by Category – List Category Posts Or Recent Posts allows Stored XSS.This issue affects Posts List Designer by Category – List Category Posts Or…

  • CVE-2023-2439MedJan 31, 2024
    WordPress
    Userpro
    risk 0.42cvss 6.4epss 0.00

    The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated…

  • CVE-2023-7225MedJan 30, 2024
    WordPress
    MapPress Maps for WordPress
    risk 0.42cvss 6.4epss 0.00

    The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2023-6389MedJan 29, 2024
    WordPress
    WordPress Toolbar
    risk 0.42cvss 6.1epss 0.27

    The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

  • CVE-2024-0697MedJan 27, 2024
    WordPress
    Backuply
    risk 0.42cvss 6.5epss 0.01

    The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the node_id parameter in the backuply_get_jstree function. This makes it possible for attackers with administrator…

Page 392 of 811