VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,574 total · sorted by risk
  • CVE-2023-5295MedSep 30, 2023
    WordPress
    Comments by Startbit
    risk 0.42cvss 6.4epss 0.00

    The Comments by Startbit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-41687MedSep 29, 2023
    Goods Catalog Project
    Goods Catalog
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Irina Sokolovskaya Goods Catalog plugin <= 2.4.1 versions.

  • CVE-2023-41666MedSep 29, 2023
    Stockdio
    Stock Quotes List
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Stockdio Stock Quotes List plugin <= 2.9.9 versions.

  • CVE-2023-5233MedSep 28, 2023
    WordPress
    Font Awesome Integration
    risk 0.42cvss 6.4epss 0.00

    The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-5232MedSep 28, 2023
    WordPress
    Font Awesome More Icons
    risk 0.42cvss 6.4epss 0.00

    The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-5230MedSep 28, 2023
    WordPress
    TM WooCommerce Compare & Wishlist
    risk 0.42cvss 6.4epss 0.00

    The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2023-40669MedSep 27, 2023
    Twinpictures
    Collapse O Matic
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in twinpictures, baden03 Collapse-O-Matic plugin <= 1.8.5.5 versions.

  • CVE-2023-40605MedSep 27, 2023
    93digital
    Typing Effect
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <= 1.3.6 versions.

  • CVE-2023-27628MedSep 27, 2023
    Sitekit Project
    Sitekit
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Webvitaly Sitekit plugin <= 1.3 versions.

  • CVE-2023-5125MedSep 23, 2023
    Formget
    Contact Form By Formget
    risk 0.42cvss 6.4epss 0.00

    The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and including, 5.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-5062MedSep 20, 2023
    WordPress
    Charts
    risk 0.42cvss 6.4epss 0.01

    The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-5001MedSep 16, 2023
    Gopiplus
    Horizontal Scrolling Announcement
    risk 0.42cvss 6.4epss 0.00

    The Horizontal scrolling announcement plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'horizontal-scrolling' shortcode in versions up to, and including, 9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2023-4963MedSep 15, 2023
    WordPress
    WS Facebook Like Box Widget
    risk 0.42cvss 6.4epss 0.00

    The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2023-4944MedSep 14, 2023
    WordPress
    Awesome Weather Widget
    risk 0.42cvss 6.4epss 0.00

    The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-4893MedSep 12, 2023
    WordPress
    Crayon Syntax Highlighter
    risk 0.42cvss 6.4epss 0.00

    The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to, and including, 2.8.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to…

  • CVE-2023-4890MedSep 12, 2023
    WordPress
    JQuery Accordion Menu Widget
    risk 0.42cvss 6.4epss 0.01

    The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2023-4887MedSep 12, 2023
    WordPress
    Google Maps Plugin by Intergeo
    risk 0.42cvss 6.4epss 0.00

    The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2023-4840MedSep 12, 2023
    WordPress
    MapPress Maps for WordPress
    risk 0.42cvss 6.4epss 0.01

    The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to, and including, 2.88.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-4838MedSep 9, 2023
    WordPress
    Simple Download Counter
    risk 0.42cvss 6.4epss 0.00

    The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'before' and 'after'. This…

  • CVE-2023-4779MedSep 6, 2023
    WordPress
    User Submitted Posts
    risk 0.42cvss 6.4epss 0.00

    The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and including, 20230811 due to insufficient input sanitization and output escaping on user supplied attributes like 'before'.…

  • CVE-2023-4773MedSep 6, 2023
    WordPress
    Social Login
    risk 0.42cvss 6.4epss 0.00

    The WordPress Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wordpress_social_login_meta' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2023-40197MedSep 4, 2023
    Flowpaper
    Flowpaper
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Devaldi Ltd flowpaper plugin <= 1.9.9 versions.

  • CVE-2023-32578MedSep 4, 2023
    WordPress
    Column-Matic
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Twinpictures Column-Matic plugin <= 1.3.3 versions.

  • CVE-2023-32102MedSep 4, 2023
    Pexlechris
    Library Viewer
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Pexle Chris Library Viewer plugin <= 2.0.6 versions.

  • CVE-2023-39988MedSep 4, 2023
    Tencent
    Wxsync
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in 标准云(std.Cloud) WxSync plugin <= 2.7.23 versions.

  • CVE-2023-38516MedSep 3, 2023
    Essentialplugin
    Audio Player With Playlist Ultimate
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2 versions.

  • CVE-2023-4718MedSep 2, 2023
    WordPress
    Font Awesome 4 Menus
    risk 0.42cvss 6.4epss 0.01

    The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2023-37994MedSep 1, 2023
    Wpruse
    Art Decoration Shortcode
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Artem Abramovich Art Decoration Shortcode plugin <= 1.5.6 versions.

  • CVE-2023-2173MedAug 31, 2023
    WordPress
    Badgeos
    risk 0.42cvss 6.5epss 0.01

    The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_delete_step_ajax_handler, badgeos_delete_award_step_ajax_handler,…

  • CVE-2023-35094MedAug 30, 2023
    Mpembed
    Wp Matterport Shortcode
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Berthelot / MPEmbed WP Matterport Shortcode plugin <= 2.1.4 versions.

  • CVE-2023-4013MedAug 30, 2023
    WordPress
    GDPR Cookie Compliance
    risk 0.42cvss 6.5epss 0.00

    The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks

  • CVE-2023-3720MedAug 30, 2023
    WordPress
    Upload Media By URL
    risk 0.42cvss 6.5epss 0.00

    The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.

  • CVE-2023-34004MedAug 30, 2023
    WooCommerce
    Box Office
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <= 1.1.50 versions.

  • CVE-2023-32793MedAug 30, 2023
    WooCommerce
    Woocommerce Pre Orders
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions.

  • CVE-2023-32746MedAug 30, 2023
    WooCommerce
    Brands
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions.

  • CVE-2023-25981MedAug 25, 2023
    Themekraft
    Post Form
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form plugin <= 2.8.1 versions.

  • CVE-2023-32576MedAug 25, 2023
    Plainware
    Locatoraid
    risk 0.42cvss 6.5epss 0.00

    Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.18 versions.

  • CVE-2023-29387MedAug 18, 2023
    Juliencrego
    Manager For Icomoon
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions.

  • CVE-2023-32103MedAug 18, 2023
    Themepalace
    Tp Education
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Theme Palace TP Education plugin <= 4.4 versions.

  • CVE-2023-31079MedAug 17, 2023
    Thechrisroberts
    Tippy
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Roberts Tippy plugin <= 6.2.1 versions.

  • CVE-2023-30784MedAug 16, 2023
    Kayastudio
    Kaya Qr Code Generator
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <= 1.5.2 versions.

  • CVE-2023-37983MedAug 10, 2023
    Noël Jackson
    Art Direction
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Noël Jackson Art Direction plugin <= 0.2.4 versions.

  • CVE-2023-24393MedAug 10, 2023
    Sk. Abul Hasan
    Animated Number Counters
    risk 0.42cvss 6.5epss 0.00

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Animated Number Counters plugin <= 1.6 versions.

  • CVE-2023-23828MedAug 10, 2023
    Swas
    Wp Category Post List
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Swashata WP Category Post List Widget plugin <= 2.0.3 versions.

  • CVE-2023-23798MedAug 10, 2023
    Web Settler
    Layer Slider
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.

  • CVE-2023-23826MedAug 10, 2023
    Webmechanix
    Add Posts To Pages
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Arsham Mirshah Add Posts to Pages plugin <= 1.4.1 versions.

  • CVE-2023-30482MedAug 8, 2023
    Villatheme
    WPBulky
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in VillaTheme WPBulky plugin <= 1.0.10 versions.

  • CVE-2023-28773MedAug 8, 2023
    Kolja Nolte
    Secondary Title
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kolja Nolte Secondary Title plugin <= 2.0.9.1 versions.

  • CVE-2023-23880MedAug 8, 2023
    ExactMetrics
    Exactmetrics
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExactMetrics plugin <= 7.14.1 versions.

  • CVE-2023-23877MedAug 8, 2023
    Bkmacdaddy
    Pinterest Rss Widget
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in bkmacdaddy designs Pinterest RSS Widget plugin <= 2.3.1 versions.

Page 398 of 812