VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,358 total · sorted by risk
  • CVE-2018-16254MedApr 12, 2019
    WordPress
    Wp All Import
    risk 0.40cvss 6.1epss 0.01

    There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by…

  • CVE-2019-6117MedApr 9, 2019
    Wpape
    Ape Gallery
    risk 0.40cvss 6.1epss 0.01

    The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function.

  • CVE-2019-9914MedMar 22, 2019
    WordPress
    Yop Poll
    risk 0.40cvss 6.1epss 0.02

    The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.

  • CVE-2019-9913MedMar 22, 2019
    WordPress
    Wp Live Chat Support
    risk 0.40cvss 6.1epss 0.01

    The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.

  • CVE-2019-9912MedMar 22, 2019
    WordPress
    Wp Google Maps
    risk 0.40cvss 6.1epss 0.03

    The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.

  • CVE-2019-9911MedMar 22, 2019
    WordPress
    Social Networks Auto Poster Facebook Twitter G
    risk 0.40cvss 6.1epss 0.01

    The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.

  • CVE-2019-9910MedMar 22, 2019
    WordPress
    Kingcomposer
    risk 0.40cvss 6.1epss 0.01

    The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.

  • CVE-2019-9909MedMar 22, 2019
    WordPress
    Donation Plugin And Fundraising Platform
    risk 0.40cvss 6.1epss 0.01

    The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.

  • CVE-2019-9908MedMar 22, 2019
    WordPress
    Font Organizer
    risk 0.40cvss 6.1epss 0.01

    The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.

  • CVE-2019-7299MedMar 21, 2019
    WordPress
    Wp Support Plus Responsive Ticket System
    risk 0.40cvss 6.1epss 0.02

    A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the subject parameter in…

  • CVE-2018-19498MedMar 21, 2019
    Simplenia
    Pages
    risk 0.40cvss 6.1epss 0.02

    The Simplenia Pages plugin 2.6.0 for Atlassian Bitbucket Server has XSS.

  • CVE-2018-18845MedMar 21, 2019
    Advanced Comment System
    Advanced Comment System
    risk 0.40cvss 6.1epss 0.01

    internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACS_path. A remote unauthenticated attacker could potentially exploit this vulnerability…

  • CVE-2019-9646MedMar 10, 2019
    WordPress
    Contact Form Email
    risk 0.40cvss 6.1epss 0.01

    The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."

  • CVE-2019-9576MedMar 5, 2019
    WordPress
    Blog2social
    risk 0.40cvss 6.1epss 0.01

    The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.

  • CVE-2019-9575MedMar 5, 2019
    Quizandsurveymaster
    Quiz And Survey Master
    risk 0.40cvss 6.1epss 0.02

    The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.

  • CVE-2019-9567MedMar 4, 2019
    WordPress
    Forminator
    risk 0.40cvss 6.1epss 0.01

    The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.

  • CVE-2019-9168MedFeb 26, 2019
    WooCommerce
    WooCommerce
    risk 0.40cvss 6.1epss 0.01

    WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.

  • CVE-2019-6267MedJan 15, 2019
    WordPress
    Easy Redirect Manager
    risk 0.40cvss 6.1epss 0.01

    The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI.

  • CVE-2018-16206MedJan 13, 2019
    WordPress
    Spam Byebye
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-16174MedJan 9, 2019
    Thimpress
    Learnpress
    risk 0.40cvss 6.1epss 0.01

    Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2018-16173MedJan 9, 2019
    Thimpress
    Learnpress
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-10736MedJan 9, 2019
    Devpups
    Social Pug
    risk 0.40cvss 6.1epss 0.01

    The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.

  • CVE-2018-20462MedDec 25, 2018
    WordPress
    Jsmol2wp
    risk 0.40cvss 6.1epss 0.04

    An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter.

  • CVE-2018-20101MedDec 12, 2018
    Codection
    Import Users From CSV With Meta
    risk 0.40cvss 6.1epss 0.01

    The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.

  • CVE-2018-19564MedNov 26, 2018
    WordPress
    Easy Testimonials
    risk 0.40cvss 6.1epss 0.01

    Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.

  • CVE-2018-17866MedOct 9, 2018
    WordPress
    Ultimatemember
    risk 0.40cvss 6.1epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or…

  • CVE-2018-17947MedOct 3, 2018
    WordPress
    Snazzy Maps
    risk 0.40cvss 6.1epss 0.01

    The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.

  • CVE-2018-17946MedOct 3, 2018
    Tribulant
    Slideshow Gallery
    risk 0.40cvss 6.1epss 0.01

    The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.

  • CVE-2018-17884MedOct 2, 2018
    WordPress
    Gwolle Guestbook
    risk 0.40cvss 6.1epss 0.01

    XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php

  • CVE-2015-9270MedOct 1, 2018
    WordPress
    The Holiday Calendar
    risk 0.40cvss 6.1epss 0.01

    XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.

  • CVE-2018-17074MedSep 16, 2018
    WordPress
    Feed Statistics
    risk 0.40cvss 6.1epss 0.01

    The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.

  • CVE-2018-0642MedSep 7, 2018
    Foliovision
    Fv Flowplayer Video Player
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-16285MedSep 6, 2018
    WordPress
    Userpro
    risk 0.40cvss 6.1epss 0.01

    The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.

  • CVE-2014-4932MedAug 28, 2018
    WordPress
    Wordfence Security
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.

  • CVE-2018-14430MedJul 25, 2018
    Mondula
    Multi Step Form
    risk 0.40cvss 6.1epss 0.01

    The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php.

  • CVE-2018-13136MedJul 4, 2018
    Ultimatemember
    Ultimatemember
    risk 0.40cvss 6.1epss 0.01

    The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.

  • CVE-2018-1000556MedJun 26, 2018
    WordPress
    WordPress
    risk 0.40cvss 6.1epss 0.01

    WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be…

  • CVE-2018-1000512MedJun 26, 2018
    Tooltipy Project
    Tooltipy
    risk 0.40cvss 6.1epss 0.01

    Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This…

  • CVE-2018-0603MedJun 26, 2018
    Geminilabs
    Site Reviews
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-0602MedJun 26, 2018
    Email Subscribers \& Newsletters Project
    Email Subscribers \& Newsletters
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-11709MedJun 4, 2018
    WordPress
    Wpforo
    risk 0.40cvss 6.1epss 0.04

    wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.

  • CVE-2018-11486MedJun 1, 2018
    Multidots
    Advance Search For Woocommerce
    risk 0.40cvss 6.1epss 0.01

    An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript…

  • CVE-2018-11485MedJun 1, 2018
    Multidots
    Woocommerce Quick Reports
    risk 0.40cvss 6.1epss 0.01

    The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the "referral_site" cookie to have…

  • CVE-2018-11568MedMay 30, 2018
    WordPress
    Gameplan
    risk 0.40cvss 6.1epss 0.01

    Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '<' and '>' characters have < and > representations.

  • CVE-2018-0579MedMay 14, 2018
    WordPress
    Open Graph for Facebook, Google+ and Twitter Card Tags
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-10301MedApr 23, 2018
    WordPress
    Instagram Feed Wd
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.

  • CVE-2018-10300MedApr 23, 2018
    WordPress
    Instagram Feed Wd
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.

  • CVE-2018-9864MedApr 9, 2018
    WordPress
    Wp Live Chat Support
    risk 0.40cvss 6.1epss 0.01

    The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.

  • CVE-2014-2297MedMar 19, 2018
    Videowhisper
    Videowhisper Live Streaming Integration
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. …

  • CVE-2018-7280MedFeb 21, 2018
    WordPress
    Ninja Forms
    risk 0.40cvss 6.1epss 0.01

    The Ninja Forms plugin before 3.2.14 for WordPress has XSS.

Page 452 of 808