Vendor CVEs
WordPress
All CVEs
40,363 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-24239 | Med | 0.40 | 6.1 | 0.02 | Apr 22, 2021 | The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting… | ||
| CVE-2021-24237 | Med | 0.40 | 6.1 | 0.06 | Apr 22, 2021 | The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting… | ||
| CVE-2021-24235 | Med | 0.40 | 6.1 | 0.03 | Apr 22, 2021 | The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue. | ||
| CVE-2021-24234 | Med | 0.40 | 6.1 | 0.01 | Apr 22, 2021 | The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form… | ||
| CVE-2021-24233 | Med | 0.40 | 6.1 | 0.02 | Apr 22, 2021 | The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute. | ||
| CVE-2021-24213 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2021 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page. | ||
| CVE-2021-24210 | Med | 0.40 | 6.1 | 0.03 | Apr 5, 2021 | There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago… | ||
| CVE-2021-24173 | Med | 0.40 | 6.1 | 0.00 | Apr 5, 2021 | The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue. | ||
| CVE-2021-24165 | Med | 0.40 | 6.1 | 0.02 | Apr 5, 2021 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place. | ||
| CVE-2021-24152 | Med | 0.40 | 6.1 | 0.01 | Apr 5, 2021 | The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting. | ||
| CVE-2021-27349 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2021 | Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727. | ||
| CVE-2021-24135 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML. | ||
| CVE-2021-24124 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation. | ||
| CVE-2020-29171 | Med | 0.40 | 6.1 | 0.01 | Feb 10, 2021 | Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress. | ||
| CVE-2020-28707 | Med | 0.40 | 6.1 | 0.01 | Jan 19, 2021 | The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The… | ||
| CVE-2020-36172 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2021 | The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS. | ||
| CVE-2020-36171 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2021 | The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. | ||
| CVE-2020-29172 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2020 | A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting. | ||
| CVE-2020-29304 | Med | 0.40 | 6.1 | 0.06 | Dec 14, 2020 | A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim… | ||
| CVE-2020-29303 | Med | 0.40 | 6.1 | 0.02 | Dec 14, 2020 | A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the… | ||
| CVE-2020-14206 | Med | 0.40 | 6.1 | 0.01 | Dec 8, 2020 | The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter). | ||
| CVE-2020-28976 | Med | 0.40 | 5.3 | 0.28 | Nov 30, 2020 | The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF. | ||
| CVE-2020-28038 | Med | 0.40 | 6.1 | 0.03 | Nov 2, 2020 | WordPress before 5.5.2 allows stored XSS via post slugs. | ||
| CVE-2020-28034 | Med | 0.40 | 6.1 | 0.02 | Nov 2, 2020 | WordPress before 5.5.2 allows XSS associated with global variables. | ||
| CVE-2020-16140 | Med | 0.40 | 6.1 | 0.01 | Oct 27, 2020 | The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS. | ||
| CVE-2020-27344 | Med | 0.40 | 6.1 | 0.01 | Oct 21, 2020 | The cm-download-manager plugin before 2.8.0 for WordPress allows XSS. | ||
| CVE-2020-5650 | Med | 0.40 | 6.1 | 0.01 | Oct 21, 2020 | Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2020-25378 | Med | 0.40 | 6.1 | 0.01 | Sep 14, 2020 | Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter. | ||
| CVE-2020-20628 | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2020 | controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS. | ||
| CVE-2020-24699 | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2020 | The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS. | ||
| CVE-2020-25033 | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2020 | The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS. | ||
| CVE-2020-24316 | Med | 0.40 | 6.1 | 0.01 | Aug 26, 2020 | WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL. | ||
| CVE-2020-24314 | Med | 0.40 | 6.1 | 0.01 | Aug 26, 2020 | Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL. | ||
| CVE-2020-24313 | Med | 0.40 | 6.1 | 0.01 | Aug 26, 2020 | Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can… | ||
| CVE-2019-6112 | Med | 0.40 | 6.1 | 0.09 | Aug 14, 2020 | A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field). | ||
| CVE-2020-17362 | Med | 0.40 | 6.1 | 0.03 | Aug 12, 2020 | search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. | ||
| CVE-2019-18834 | Med | 0.40 | 6.1 | 0.02 | Jul 23, 2020 | Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php. | ||
| CVE-2020-14063 | Med | 0.40 | 6.1 | 0.01 | Jul 21, 2020 | A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and… | ||
| CVE-2020-15537 | Med | 0.40 | 6.1 | 0.01 | Jul 5, 2020 | An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box. | ||
| CVE-2020-15536 | Med | 0.40 | 6.1 | 0.01 | Jul 5, 2020 | An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields. | ||
| CVE-2020-15535 | Med | 0.40 | 6.1 | 0.01 | Jul 5, 2020 | An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields. | ||
| CVE-2019-19112 | Med | 0.40 | 6.1 | 0.01 | Jun 15, 2020 | The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. | ||
| CVE-2019-19111 | Med | 0.40 | 6.1 | 0.01 | Jun 15, 2020 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. | ||
| CVE-2020-14010 | Med | 0.40 | 6.1 | 0.01 | Jun 10, 2020 | The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter. | ||
| CVE-2019-11843 | Med | 0.40 | 6.1 | 0.02 | Jun 2, 2020 | The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS). | ||
| CVE-2020-12742 | Med | 0.40 | 6.1 | 0.01 | May 13, 2020 | The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. | ||
| CVE-2020-12696 | Med | 0.40 | 6.1 | 0.02 | May 7, 2020 | The iframe plugin before 4.5 for WordPress does not sanitize a URL. | ||
| CVE-2020-11727 | Med | 0.40 | 6.1 | 0.02 | May 6, 2020 | A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter. | ||
| CVE-2020-12462 | Med | 0.40 | 6.1 | 0.00 | Apr 29, 2020 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. | ||
| CVE-2020-12054 | Med | 0.40 | 6.1 | 0.04 | Apr 23, 2020 | The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean… |
- risk 0.40cvss 6.1epss 0.02
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting…
- risk 0.40cvss 6.1epss 0.06
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting…
- risk 0.40cvss 6.1epss 0.03
The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.
- risk 0.40cvss 6.1epss 0.01
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form…
- risk 0.40cvss 6.1epss 0.02
The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
- risk 0.40cvss 6.1epss 0.01
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
- risk 0.40cvss 6.1epss 0.03
There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago…
- risk 0.40cvss 6.1epss 0.00
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue.
- risk 0.40cvss 6.1epss 0.02
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
- risk 0.40cvss 6.1epss 0.01
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.
- risk 0.40cvss 6.1epss 0.01
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.
- risk 0.40cvss 6.1epss 0.01
Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
- risk 0.40cvss 6.1epss 0.01
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The…
- risk 0.40cvss 6.1epss 0.01
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
- risk 0.40cvss 6.1epss 0.01
The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.
- risk 0.40cvss 6.1epss 0.06
A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim…
- risk 0.40cvss 6.1epss 0.02
A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the…
- risk 0.40cvss 6.1epss 0.01
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
- risk 0.40cvss 5.3epss 0.28
The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.
- risk 0.40cvss 6.1epss 0.03
WordPress before 5.5.2 allows stored XSS via post slugs.
- risk 0.40cvss 6.1epss 0.02
WordPress before 5.5.2 allows XSS associated with global variables.
- risk 0.40cvss 6.1epss 0.01
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.
- risk 0.40cvss 6.1epss 0.01
The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.
- risk 0.40cvss 6.1epss 0.01
controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.
- risk 0.40cvss 6.1epss 0.01
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
- risk 0.40cvss 6.1epss 0.01
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
- risk 0.40cvss 6.1epss 0.01
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
- risk 0.40cvss 6.1epss 0.01
Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
- risk 0.40cvss 6.1epss 0.01
Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can…
- risk 0.40cvss 6.1epss 0.09
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
- risk 0.40cvss 6.1epss 0.03
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
- risk 0.40cvss 6.1epss 0.02
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.
- risk 0.40cvss 6.1epss 0.01
A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields.
- risk 0.40cvss 6.1epss 0.01
The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
- risk 0.40cvss 6.1epss 0.01
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.
- risk 0.40cvss 6.1epss 0.01
The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
- risk 0.40cvss 6.1epss 0.02
The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).
- risk 0.40cvss 6.1epss 0.01
The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
- risk 0.40cvss 6.1epss 0.02
The iframe plugin before 4.5 for WordPress does not sanitize a URL.
- risk 0.40cvss 6.1epss 0.02
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.
- risk 0.40cvss 6.1epss 0.00
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
- risk 0.40cvss 6.1epss 0.04
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean…
Page 443 of 808