Vendor CVEs
WordPress
All CVEs
40,360 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10936 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option. | ||
| CVE-2015-9350 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button. | ||
| CVE-2019-15644 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS. | ||
| CVE-2019-15643 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The ultimate-faqs plugin before 1.8.22 for WordPress has XSS. | ||
| CVE-2018-21001 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The anycomment plugin before 0.0.33 for WordPress has XSS. | ||
| CVE-2017-18590 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. | ||
| CVE-2016-10934 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The check-email plugin before 0.5.2 for WordPress has XSS. | ||
| CVE-2015-9349 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser. | ||
| CVE-2015-9347 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors. | ||
| CVE-2015-9346 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The cp-polls plugin before 1.0.5 for WordPress has XSS. | ||
| CVE-2015-9342 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The wp-rollback plugin before 1.2.3 for WordPress has XSS. | ||
| CVE-2014-10395 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. | ||
| CVE-2019-15328 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. | ||
| CVE-2019-15327 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. | ||
| CVE-2017-18579 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The corner-ad plugin before 1.0.8 for WordPress has XSS. | ||
| CVE-2017-18578 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS. | ||
| CVE-2014-10393 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The cforms2 plugin before 10.5 for WordPress has XSS. | ||
| CVE-2014-10386 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections. | ||
| CVE-2019-15331 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. | ||
| CVE-2014-10394 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header. | ||
| CVE-2014-10392 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The cforms2 plugin before 10.2 for WordPress has XSS. | ||
| CVE-2014-10391 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection. | ||
| CVE-2018-20983 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The wp-retina-2x plugin before 5.2.3 for WordPress has XSS. | ||
| CVE-2017-18582 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues. | ||
| CVE-2017-18581 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list. | ||
| CVE-2017-18577 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. | ||
| CVE-2017-18576 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation. | ||
| CVE-2016-10925 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs. | ||
| CVE-2014-10385 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST. | ||
| CVE-2013-7482 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The reflex-gallery plugin before 1.4.3 for WordPress has XSS. | ||
| CVE-2008-7321 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The tubepress plugin before 1.6.5 for WordPress has XSS. | ||
| CVE-2018-20982 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens. | ||
| CVE-2017-18575 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues. | ||
| CVE-2017-18574 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. | ||
| CVE-2017-18572 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The gnucommerce plugin before 1.4.2 for WordPress has XSS. | ||
| CVE-2016-10920 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS. | ||
| CVE-2016-10919 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633. | ||
| CVE-2015-9336 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The clean-login plugin before 1.5.1 for WordPress has reflected XSS. | ||
| CVE-2013-7481 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. | ||
| CVE-2013-7480 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. | ||
| CVE-2013-7479 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. | ||
| CVE-2013-7478 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. | ||
| CVE-2013-7477 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. | ||
| CVE-2012-6716 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. | ||
| CVE-2009-5158 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text. | ||
| CVE-2018-20977 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page. | ||
| CVE-2018-20970 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues. | ||
| CVE-2017-18562 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18561 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The embed-comment-images plugin before 0.6 for WordPress has XSS. | ||
| CVE-2017-18559 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues. |
- risk 0.40cvss 6.1epss 0.01
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
- risk 0.40cvss 6.1epss 0.01
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
- risk 0.40cvss 6.1epss 0.01
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
- risk 0.40cvss 6.1epss 0.01
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The anycomment plugin before 0.0.33 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The check-email plugin before 0.5.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
- risk 0.40cvss 6.1epss 0.01
The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
- risk 0.40cvss 6.1epss 0.01
The cp-polls plugin before 1.0.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-rollback plugin before 1.2.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
- risk 0.40cvss 6.1epss 0.01
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
- risk 0.40cvss 6.1epss 0.01
The corner-ad plugin before 1.0.8 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 10.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
- risk 0.40cvss 6.1epss 0.01
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.
- risk 0.40cvss 6.1epss 0.01
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 10.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.
- risk 0.40cvss 6.1epss 0.01
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
- risk 0.40cvss 6.1epss 0.01
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
- risk 0.40cvss 6.1epss 0.01
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
- risk 0.40cvss 6.1epss 0.01
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
- risk 0.40cvss 6.1epss 0.01
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
- risk 0.40cvss 6.1epss 0.01
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The tubepress plugin before 1.6.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
- risk 0.40cvss 6.1epss 0.01
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
- risk 0.40cvss 6.1epss 0.01
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
- risk 0.40cvss 6.1epss 0.01
The gnucommerce plugin before 1.4.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
- risk 0.40cvss 6.1epss 0.01
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
- risk 0.40cvss 6.1epss 0.01
The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
- risk 0.40cvss 6.1epss 0.01
The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The embed-comment-images plugin before 0.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
Page 448 of 808