Vendor CVEs
WordPress
All CVEs
40,360 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-9453 | Med | 0.40 | 6.1 | 0.02 | Oct 7, 2019 | The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist. | ||
| CVE-2018-18379 | Med | 0.40 | 6.1 | 0.01 | Oct 7, 2019 | The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. | ||
| CVE-2019-17213 | Med | 0.40 | 6.1 | 0.01 | Oct 6, 2019 | The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. | ||
| CVE-2019-16931 | Med | 0.40 | 6.1 | 0.03 | Oct 3, 2019 | A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php… | ||
| CVE-2015-9444 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF. | ||
| CVE-2015-9430 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header. | ||
| CVE-2015-9420 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter. | ||
| CVE-2015-9419 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section. | ||
| CVE-2015-9416 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header. | ||
| CVE-2015-9414 | Med | 0.40 | 6.1 | 0.04 | Sep 26, 2019 | The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter. | ||
| CVE-2015-9412 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. | ||
| CVE-2015-9411 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The Postmatic plugin before 1.4.6 for WordPress has XSS. | ||
| CVE-2015-9407 | Med | 0.40 | 6.1 | 0.02 | Sep 20, 2019 | The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. | ||
| CVE-2015-9404 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. | ||
| CVE-2015-9403 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. | ||
| CVE-2015-9396 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. | ||
| CVE-2016-11005 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS. | ||
| CVE-2016-11001 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. | ||
| CVE-2016-10999 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter. | ||
| CVE-2016-10998 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS. | ||
| CVE-2015-9391 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. | ||
| CVE-2015-9386 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. | ||
| CVE-2015-9385 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The quotes-and-tips plugin before 1.20 for WordPress has XSS. | ||
| CVE-2015-9384 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The relevant plugin before 1.0.8 for WordPress has XSS. | ||
| CVE-2019-16525 | Med | 0.40 | 6.1 | 0.06 | Sep 19, 2019 | An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code. | ||
| CVE-2016-10994 | Med | 0.40 | 6.1 | 0.01 | Sep 18, 2019 | The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter. | ||
| CVE-2016-10992 | Med | 0.40 | 6.1 | 0.02 | Sep 17, 2019 | The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter. | ||
| CVE-2016-10990 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header. | ||
| CVE-2016-10988 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer. | ||
| CVE-2016-10987 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS. | ||
| CVE-2016-10986 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret. | ||
| CVE-2016-10985 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. | ||
| CVE-2016-10984 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. | ||
| CVE-2016-10981 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text. | ||
| CVE-2016-10980 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo. | ||
| CVE-2016-10979 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS. | ||
| CVE-2016-10976 | Med | 0.40 | 6.1 | 0.02 | Sep 17, 2019 | The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS. | ||
| CVE-2016-10975 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter. | ||
| CVE-2016-10973 | Med | 0.40 | 6.1 | 0.02 | Sep 16, 2019 | The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php. | ||
| CVE-2016-10967 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter. | ||
| CVE-2016-10964 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header. | ||
| CVE-2016-10963 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The icegram plugin before 1.9.19 for WordPress has XSS. | ||
| CVE-2016-10961 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter. | ||
| CVE-2016-10957 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter. | ||
| CVE-2019-16332 | Med | 0.40 | 6.1 | 0.06 | Sep 15, 2019 | In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS. | ||
| CVE-2019-12517 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later… | ||
| CVE-2016-10952 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter. | ||
| CVE-2017-18615 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. | ||
| CVE-2017-18613 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. | ||
| CVE-2017-18612 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. |
- risk 0.40cvss 6.1epss 0.02
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
- risk 0.40cvss 6.1epss 0.01
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
- risk 0.40cvss 6.1epss 0.03
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php…
- risk 0.40cvss 6.1epss 0.01
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
- risk 0.40cvss 6.1epss 0.01
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.
- risk 0.40cvss 6.1epss 0.01
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
- risk 0.40cvss 6.1epss 0.01
The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
- risk 0.40cvss 6.1epss 0.01
The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
- risk 0.40cvss 6.1epss 0.04
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
- risk 0.40cvss 6.1epss 0.01
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
- risk 0.40cvss 6.1epss 0.01
The Postmatic plugin before 1.4.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.02
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
- risk 0.40cvss 6.1epss 0.01
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
- risk 0.40cvss 6.1epss 0.01
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
- risk 0.40cvss 6.1epss 0.01
The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.
- risk 0.40cvss 6.1epss 0.01
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
- risk 0.40cvss 6.1epss 0.01
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
- risk 0.40cvss 6.1epss 0.01
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
- risk 0.40cvss 6.1epss 0.01
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
- risk 0.40cvss 6.1epss 0.01
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.
- risk 0.40cvss 6.1epss 0.01
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
- risk 0.40cvss 6.1epss 0.01
The quotes-and-tips plugin before 1.20 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The relevant plugin before 1.0.8 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.06
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.
- risk 0.40cvss 6.1epss 0.01
The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
- risk 0.40cvss 6.1epss 0.02
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
- risk 0.40cvss 6.1epss 0.01
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
- risk 0.40cvss 6.1epss 0.01
The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.
- risk 0.40cvss 6.1epss 0.01
The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
- risk 0.40cvss 6.1epss 0.01
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
- risk 0.40cvss 6.1epss 0.01
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
- risk 0.40cvss 6.1epss 0.01
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
- risk 0.40cvss 6.1epss 0.01
The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
- risk 0.40cvss 6.1epss 0.01
The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
- risk 0.40cvss 6.1epss 0.01
The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.02
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
- risk 0.40cvss 6.1epss 0.01
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
- risk 0.40cvss 6.1epss 0.02
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.
- risk 0.40cvss 6.1epss 0.01
The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.
- risk 0.40cvss 6.1epss 0.01
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.
- risk 0.40cvss 6.1epss 0.01
The icegram plugin before 1.9.19 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
- risk 0.40cvss 6.1epss 0.01
The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
- risk 0.40cvss 6.1epss 0.06
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later…
- risk 0.40cvss 6.1epss 0.01
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
- risk 0.40cvss 6.1epss 0.01
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
- risk 0.40cvss 6.1epss 0.01
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
Page 446 of 808