Vendor CVEs
WordPress
All CVEs
40,360 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-18608 | Med | 0.40 | 6.1 | 0.01 | Sep 10, 2019 | The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues. | ||
| CVE-2017-18606 | Med | 0.40 | 6.1 | 0.01 | Sep 10, 2019 | The avada theme before 5.1.5 for WordPress has stored XSS. | ||
| CVE-2017-18603 | Med | 0.40 | 6.1 | 0.01 | Sep 10, 2019 | The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter. | ||
| CVE-2017-18599 | Med | 0.40 | 6.1 | 0.01 | Sep 10, 2019 | The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter. | ||
| CVE-2017-18598 | Med | 0.40 | 6.1 | 0.02 | Sep 10, 2019 | The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php. | ||
| CVE-2018-21012 | Med | 0.40 | 6.1 | 0.01 | Sep 9, 2019 | The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS. | ||
| CVE-2019-15864 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2019 | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. | ||
| CVE-2019-15842 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS. | ||
| CVE-2019-15838 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. | ||
| CVE-2019-15833 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. | ||
| CVE-2019-15820 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication. | ||
| CVE-2019-15818 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist. | ||
| CVE-2019-15817 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The easy-property-listings plugin before 3.4 for WordPress has XSS. | ||
| CVE-2019-15771 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2019 | The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | ||
| CVE-2019-15776 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2019 | The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file. | ||
| CVE-2019-15775 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2019 | The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | ||
| CVE-2019-15774 | Med | 0.40 | 6.1 | 0.02 | Aug 29, 2019 | The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | ||
| CVE-2019-15773 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2019 | The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | ||
| CVE-2019-15772 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2019 | The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. | ||
| CVE-2015-9359 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9379 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9378 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9377 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9376 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9375 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9374 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9373 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9372 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9371 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9370 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9369 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2019-15713 | Med | 0.40 | 6.1 | 0.02 | Aug 28, 2019 | The my-calendar plugin before 3.1.10 for WordPress has XSS. | ||
| CVE-2017-18593 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file. | ||
| CVE-2015-9368 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9367 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9366 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9365 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9364 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9363 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9362 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9361 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9360 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9358 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9357 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The akismet plugin before 3.1.5 for WordPress has XSS. | ||
| CVE-2015-9356 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460. | ||
| CVE-2015-9355 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area. | ||
| CVE-2012-6718 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491. | ||
| CVE-2012-6717 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562. | ||
| CVE-2011-5329 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562. | ||
| CVE-2017-18591 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php. |
- risk 0.40cvss 6.1epss 0.01
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The avada theme before 5.1.5 for WordPress has stored XSS.
- risk 0.40cvss 6.1epss 0.01
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
- risk 0.40cvss 6.1epss 0.01
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
- risk 0.40cvss 6.1epss 0.02
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
- risk 0.40cvss 6.1epss 0.01
The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
- risk 0.40cvss 6.1epss 0.01
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
- risk 0.40cvss 6.1epss 0.01
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
- risk 0.40cvss 6.1epss 0.01
The easy-property-listings plugin before 3.4 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- risk 0.40cvss 6.1epss 0.01
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
- risk 0.40cvss 6.1epss 0.01
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- risk 0.40cvss 6.1epss 0.02
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- risk 0.40cvss 6.1epss 0.01
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- risk 0.40cvss 6.1epss 0.01
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- risk 0.40cvss 6.1epss 0.01
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.02
The my-calendar plugin before 3.1.10 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
- risk 0.40cvss 6.1epss 0.01
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
The akismet plugin before 3.1.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
- risk 0.40cvss 6.1epss 0.01
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
- risk 0.40cvss 6.1epss 0.01
The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.
- risk 0.40cvss 6.1epss 0.01
The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
- risk 0.40cvss 6.1epss 0.01
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
- risk 0.40cvss 6.1epss 0.01
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
Page 447 of 808