Vendor CVEs
WordPress
All CVEs
40,358 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-9293 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature. | ||
| CVE-2013-7475 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-plugin plugin before 3.52 for WordPress has XSS. | ||
| CVE-2012-6713 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues. | ||
| CVE-2018-20966 | Med | 0.40 | 6.1 | 0.02 | Aug 12, 2019 | The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature. | ||
| CVE-2017-18505 | Med | 0.40 | 6.1 | 0.02 | Aug 12, 2019 | The twitter-plugin plugin before 2.55 for WordPress has XSS. | ||
| CVE-2017-18503 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS. | ||
| CVE-2017-18502 | Med | 0.40 | 6.1 | 0.02 | Aug 12, 2019 | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. | ||
| CVE-2017-18501 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. | ||
| CVE-2017-18500 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. | ||
| CVE-2017-18499 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The simple-membership plugin before 3.5.7 for WordPress has XSS. | ||
| CVE-2015-9304 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. | ||
| CVE-2015-9303 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS. | ||
| CVE-2019-14950 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. | ||
| CVE-2019-14949 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-database-backup plugin before 5.1.2 for WordPress has XSS. | ||
| CVE-2017-18508 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. | ||
| CVE-2017-18506 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens. | ||
| CVE-2016-10879 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. | ||
| CVE-2016-10878 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS. | ||
| CVE-2016-10877 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues. | ||
| CVE-2016-10875 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-database-backup plugin before 4.3.1 for WordPress has XSS. | ||
| CVE-2016-10873 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-database-backup plugin before 4.3.3 for WordPress has XSS. | ||
| CVE-2015-9306 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. | ||
| CVE-2015-9305 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions. | ||
| CVE-2019-14791 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. | ||
| CVE-2019-14799 | Med | 0.40 | 6.1 | 0.02 | Aug 9, 2019 | The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. | ||
| CVE-2016-10865 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS. | ||
| CVE-2019-14774 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter. | ||
| CVE-2019-14364 | Med | 0.40 | 6.1 | 0.01 | Jul 28, 2019 | An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter. | ||
| CVE-2019-13505 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2019 | The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. | ||
| CVE-2019-13414 | Med | 0.40 | 6.1 | 0.01 | Jul 8, 2019 | The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php. | ||
| CVE-2019-5972 | Med | 0.40 | 6.1 | 0.02 | Jul 5, 2019 | Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2019-5970 | Med | 0.40 | 6.1 | 0.02 | Jul 5, 2019 | Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2019-5962 | Med | 0.40 | 6.1 | 0.02 | Jul 5, 2019 | Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2019-12346 | Med | 0.40 | 6.1 | 0.01 | Jun 24, 2019 | In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post. | ||
| CVE-2013-7472 | Med | 0.40 | 6.1 | 0.01 | Jun 15, 2019 | The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter. | ||
| CVE-2019-12345 | Med | 0.40 | 6.1 | 0.01 | May 27, 2019 | XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress. | ||
| CVE-2019-11869 | Med | 0.40 | 6.1 | 0.04 | May 9, 2019 | The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into… | ||
| CVE-2019-9669 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2019 | The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but… | ||
| CVE-2019-10864 | Med | 0.40 | 6.1 | 0.01 | Apr 23, 2019 | The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request. | ||
| CVE-2018-18019 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter. | ||
| CVE-2018-18017 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter. | ||
| CVE-2018-16967 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter. | ||
| CVE-2018-17586 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action. | ||
| CVE-2018-17585 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter. | ||
| CVE-2018-17583 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action. | ||
| CVE-2018-16259 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be… | ||
| CVE-2018-16258 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16257 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16256 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16255 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by… |
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.02
The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.
- risk 0.40cvss 6.1epss 0.02
The twitter-plugin plugin before 2.55 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.02
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The simple-membership plugin before 3.5.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
- risk 0.40cvss 6.1epss 0.01
The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
- risk 0.40cvss 6.1epss 0.01
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
- risk 0.40cvss 6.1epss 0.01
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
- risk 0.40cvss 6.1epss 0.02
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
- risk 0.40cvss 6.1epss 0.01
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
- risk 0.40cvss 6.1epss 0.01
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
- risk 0.40cvss 6.1epss 0.01
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
- risk 0.40cvss 6.1epss 0.01
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
- risk 0.40cvss 6.1epss 0.01
The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.
- risk 0.40cvss 6.1epss 0.01
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
- risk 0.40cvss 6.1epss 0.01
XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.
- risk 0.40cvss 6.1epss 0.04
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into…
- risk 0.40cvss 6.1epss 0.01
The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but…
- risk 0.40cvss 6.1epss 0.01
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
- risk 0.40cvss 6.1epss 0.01
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
- risk 0.40cvss 6.1epss 0.01
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
- risk 0.40cvss 6.1epss 0.01
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
- risk 0.40cvss 6.1epss 0.01
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter.
- risk 0.40cvss 6.1epss 0.01
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by…
Page 451 of 808