Vendor CVEs

WordPress

All CVEs

40,358 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2017-14622	WordPress 2kb Amazon Affiliates Store	Med	0.40	6.1	0.03	Sep 28, 2017	Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php.
CVE-2017-14751	WordPress WP Jobs	Med	0.40	6.1	0.01	Sep 26, 2017	The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.
CVE-2017-1002017	WordPress Gift Certificate Creator	Med	0.40	6.1	0.01	Sep 14, 2017	Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.
CVE-2017-14313	WordPress Shibboleth	Med	0.40	6.1	0.01	Sep 12, 2017	The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().
CVE-2015-8353	WordPress Role Scoper	Med	0.40	6.1	0.02	Sep 11, 2017	Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
CVE-2015-8350	WordPress Calls to Action	Med	0.40	6.1	0.03	Sep 11, 2017	Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2)…
CVE-2017-10837	WordPress BackupGuard	Med	0.40	6.1	0.01	Aug 29, 2017	Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-13138	WordPress Bridge	Med	0.40	6.1	0.01	Aug 23, 2017	DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.
CVE-2017-12948	Pressforward Pressforward	Med	0.40	6.1	0.01	Aug 18, 2017	Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.
CVE-2017-2285	Silkypress Simple Custom CSS And Js	Med	0.40	6.1	0.01	Aug 2, 2017	Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2284	Popup Maker Popup Maker	Med	0.40	6.1	0.02	Aug 2, 2017	Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-12200	Etoilewebdesign Ultimate Product Catalog	Med	0.40	6.1	0.01	Aug 2, 2017	The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.
CVE-2017-12131	WordPress Easy Testimonials	Med	0.40	6.1	0.01	Aug 1, 2017	The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.
CVE-2017-12068	WordPress Event List	Med	0.40	6.1	0.01	Aug 1, 2017	The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.
CVE-2015-3421	WordPress eShop	Med	0.40	6.1	0.01	Jul 21, 2017	The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables…
CVE-2017-1000038	Relevanssi Relevanssi	Med	0.40	6.1	0.01	Jul 17, 2017	WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
CVE-2017-1000033	WordPress Vospari Forms	Med	0.40	6.1	0.02	Jul 17, 2017	Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user.
CVE-2017-10991	Wp Statistics Wp Statistics	Med	0.40	6.1	0.01	Jul 7, 2017	The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.
CVE-2017-2243	Dfactory Responsive Lightbox	Med	0.40	6.1	0.01	Jul 7, 2017	Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2224	Web Dorado Event Calendar Wd	Med	0.40	6.1	0.01	Jul 7, 2017	Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2222	Butlerblog Wp Members	Med	0.40	6.1	0.02	Jul 7, 2017	Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2217	WordPress Download Manager	Med	0.40	6.1	0.01	Jul 7, 2017	Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2017-2216	WordPress Download Manager	Med	0.40	6.1	0.01	Jul 7, 2017	Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2187	WordPress Wp Live Chat Support	Med	0.40	6.1	0.01	Jun 9, 2017	Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-9310	WordPress WordPress Backup to Dropbox	Med	0.40	6.1	0.01	Jun 7, 2017	Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.
CVE-2017-2169	Maxfoundry Maxbuttons	Med	0.40	6.1	0.01	May 22, 2017	Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2168	Wpbookingsystem Wp Booking System	Med	0.40	6.1	0.01	May 22, 2017	Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-4903	Wp Olivecart Olivecart	Med	0.40	6.1	0.01	May 22, 2017	Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-4070	WordPress Wow Moodboard Lite	Med	0.40	6.1	0.01	May 17, 2017	Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
CVE-2015-3998	WordPress adsense-click-fraud-monitoring	Med	0.40	6.1	0.01	May 17, 2017	Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
CVE-2017-2151	Wpdevart Booking Calendar	Med	0.40	6.1	0.01	Apr 28, 2017	Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2147	Wp Statistics Wp Statistics	Med	0.40	6.1	0.01	Apr 28, 2017	Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2136	Wp Statistics Wp Statistics	Med	0.40	6.1	0.03	Apr 28, 2017	Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
CVE-2017-2135	Wp Statistics Wp Statistics	Med	0.40	6.1	0.02	Apr 28, 2017	Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-0770	WordPress Connections Business Directory	Med	0.40	6.1	0.02	Mar 16, 2017	Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.
CVE-2017-6103	WordPress AnyVar	Med	0.40	6.1	0.01	Mar 2, 2017	Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.
CVE-2017-6102	WordPress rockhoist-badges	Med	0.40	6.1	0.01	Mar 2, 2017	Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.
CVE-2017-5942	WordPress Wp Mail	Med	0.40	6.1	0.01	Feb 10, 2017	An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the context of the user receiving the mail.
CVE-2016-0765	WordPress eShop	Med	0.40	6.1	0.02	Jan 23, 2017	Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.
CVE-2017-5490	WordPress WordPress	Med	0.40	6.1	0.02	Jan 15, 2017	Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to…
CVE-2017-5488	WordPress WordPress	Med	0.40	6.1	0.02	Jan 15, 2017	Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
CVE-2016-1000155	WPSOLR Wpsolr Search Engine	Med	0.40	6.1	0.04	Oct 10, 2016	Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
CVE-2016-1000154	WordPress Whizz	Med	0.40	6.1	0.03	Oct 10, 2016	Reflected XSS in wordpress plugin whizz v1.0.7
CVE-2016-1000153	WordPress Tidio Gallery	Med	0.40	6.1	0.04	Oct 10, 2016	Reflected XSS in wordpress plugin tidio-gallery v1.1
CVE-2016-1000152	WordPress Tidio Form	Med	0.40	6.1	0.04	Oct 10, 2016	Reflected XSS in wordpress plugin tidio-form v1.0
CVE-2016-1000151	WordPress Tera Charts	Med	0.40	6.1	0.02	Oct 10, 2016	Reflected XSS in wordpress plugin tera-charts v1.0
CVE-2016-1000150	WordPress Simplified Content	Med	0.40	6.1	0.02	Oct 10, 2016	Reflected XSS in wordpress plugin simplified-content v1.0.0
CVE-2016-1000149	WordPress Simpel Reserveren	Med	0.40	6.1	0.04	Oct 10, 2016	Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
CVE-2016-1000148	WordPress S3 Video	Med	0.40	6.1	0.03	Oct 10, 2016	Reflected XSS in wordpress plugin s3-video v0.983
CVE-2016-1000147	WordPress Recipes Writer	Med	0.40	6.1	0.02	Oct 10, 2016	Reflected XSS in wordpress plugin recipes-writer v1.0.4

CVE-2017-14622MedSep 28, 2017
WordPress
2kb Amazon Affiliates Store
risk 0.40cvss 6.1epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php.
CVE-2017-14751MedSep 26, 2017
WordPress
WP Jobs
risk 0.40cvss 6.1epss 0.01
The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.
CVE-2017-1002017MedSep 14, 2017
WordPress
Gift Certificate Creator
risk 0.40cvss 6.1epss 0.01
Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.
CVE-2017-14313MedSep 12, 2017
WordPress
Shibboleth
risk 0.40cvss 6.1epss 0.01
The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().
CVE-2015-8353MedSep 11, 2017
WordPress
Role Scoper
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
CVE-2015-8350MedSep 11, 2017
WordPress
Calls to Action
risk 0.40cvss 6.1epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2)…
CVE-2017-10837MedAug 29, 2017
WordPress
BackupGuard
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-13138MedAug 23, 2017
WordPress
Bridge
risk 0.40cvss 6.1epss 0.01
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.
CVE-2017-12948MedAug 18, 2017
Pressforward
Pressforward
risk 0.40cvss 6.1epss 0.01
Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.
CVE-2017-2285MedAug 2, 2017
Silkypress
Simple Custom CSS And Js
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2284MedAug 2, 2017
Popup Maker
Popup Maker
risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-12200MedAug 2, 2017
Etoilewebdesign
Ultimate Product Catalog
risk 0.40cvss 6.1epss 0.01
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.
CVE-2017-12131MedAug 1, 2017
WordPress
Easy Testimonials
risk 0.40cvss 6.1epss 0.01
The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.
CVE-2017-12068MedAug 1, 2017
WordPress
Event List
risk 0.40cvss 6.1epss 0.01
The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.
CVE-2015-3421MedJul 21, 2017
WordPress
eShop
risk 0.40cvss 6.1epss 0.01
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables…
CVE-2017-1000038MedJul 17, 2017
Relevanssi
Relevanssi
risk 0.40cvss 6.1epss 0.01
WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
CVE-2017-1000033MedJul 17, 2017
WordPress
Vospari Forms
risk 0.40cvss 6.1epss 0.02
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user.
CVE-2017-10991MedJul 7, 2017
Wp Statistics
Wp Statistics
risk 0.40cvss 6.1epss 0.01
The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.
CVE-2017-2243MedJul 7, 2017
Dfactory
Responsive Lightbox
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Responsive Lightbox prior to version 1.7.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2224MedJul 7, 2017
Web Dorado
Event Calendar Wd
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2222MedJul 7, 2017
Butlerblog
Wp Members
risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2217MedJul 7, 2017
WordPress
Download Manager
risk 0.40cvss 6.1epss 0.01
Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2017-2216MedJul 7, 2017
WordPress
Download Manager
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2187MedJun 9, 2017
WordPress
Wp Live Chat Support
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-9310MedJun 7, 2017
WordPress
WordPress Backup to Dropbox
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.
CVE-2017-2169MedMay 22, 2017
Maxfoundry
Maxbuttons
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2168MedMay 22, 2017
Wpbookingsystem
Wp Booking System
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-4903MedMay 22, 2017
Wp Olivecart
Olivecart
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-4070MedMay 17, 2017
WordPress
Wow Moodboard Lite
risk 0.40cvss 6.1epss 0.01
Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
CVE-2015-3998MedMay 17, 2017
WordPress
adsense-click-fraud-monitoring
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
CVE-2017-2151MedApr 28, 2017
Wpdevart
Booking Calendar
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2147MedApr 28, 2017
Wp Statistics
Wp Statistics
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2136MedApr 28, 2017
Wp Statistics
Wp Statistics
risk 0.40cvss 6.1epss 0.03
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
CVE-2017-2135MedApr 28, 2017
Wp Statistics
Wp Statistics
risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-0770MedMar 16, 2017
WordPress
Connections Business Directory
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.
CVE-2017-6103MedMar 2, 2017
WordPress
AnyVar
risk 0.40cvss 6.1epss 0.01
Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.
CVE-2017-6102MedMar 2, 2017
WordPress
rockhoist-badges
risk 0.40cvss 6.1epss 0.01
Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.
CVE-2017-5942MedFeb 10, 2017
WordPress
Wp Mail
risk 0.40cvss 6.1epss 0.01
An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the context of the user receiving the mail.
CVE-2016-0765MedJan 23, 2017
WordPress
eShop
risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.
CVE-2017-5490MedJan 15, 2017
WordPress
WordPress
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to…
CVE-2017-5488MedJan 15, 2017
WordPress
WordPress
risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
CVE-2016-1000155MedOct 10, 2016
WPSOLR
Wpsolr Search Engine
risk 0.40cvss 6.1epss 0.04
Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
CVE-2016-1000154MedOct 10, 2016
WordPress
Whizz
risk 0.40cvss 6.1epss 0.03
Reflected XSS in wordpress plugin whizz v1.0.7
CVE-2016-1000153MedOct 10, 2016
WordPress
Tidio Gallery
risk 0.40cvss 6.1epss 0.04
Reflected XSS in wordpress plugin tidio-gallery v1.1
CVE-2016-1000152MedOct 10, 2016
WordPress
Tidio Form
risk 0.40cvss 6.1epss 0.04
Reflected XSS in wordpress plugin tidio-form v1.0
CVE-2016-1000151MedOct 10, 2016
WordPress
Tera Charts
risk 0.40cvss 6.1epss 0.02
Reflected XSS in wordpress plugin tera-charts v1.0
CVE-2016-1000150MedOct 10, 2016
WordPress
Simplified Content
risk 0.40cvss 6.1epss 0.02
Reflected XSS in wordpress plugin simplified-content v1.0.0
CVE-2016-1000149MedOct 10, 2016
WordPress
Simpel Reserveren
risk 0.40cvss 6.1epss 0.04
Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
CVE-2016-1000148MedOct 10, 2016
WordPress
S3 Video
risk 0.40cvss 6.1epss 0.03
Reflected XSS in wordpress plugin s3-video v0.983
CVE-2016-1000147MedOct 10, 2016
WordPress
Recipes Writer
risk 0.40cvss 6.1epss 0.02
Reflected XSS in wordpress plugin recipes-writer v1.0.4

Page 454 of 808