VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,232 total · sorted by risk
  • CVE-2023-25047MedOct 31, 2023
    Carrcommunications
    Rsvpmaker
    risk 0.36cvss 5.5epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.

  • CVE-2023-5745MedOct 25, 2023
    WordPress
    Reusable Text Blocks
    risk 0.36cvss 5.5epss 0.01

    The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2022-4954MedOct 20, 2023
    Plugin
    Waiting
    risk 0.36cvss 5.5epss 0.00

    The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2023-30778MedAug 15, 2023
    Blubrry
    Powerpress
    risk 0.36cvss 5.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin <= 10.0.1 versions.

  • CVE-2022-4953MedAug 14, 2023
    Elementor
    Website Builder
    risk 0.36cvss 6.1epss 0.03

    The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.

  • CVE-2023-4140MedAug 4, 2023
    WordPress
    Wp Ultimate CSV Importer
    risk 0.36cvss 6.6epss 0.01

    The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such…

  • CVE-2020-36722MedJun 7, 2023
    WordPress
    Visualcomposer
    risk 0.36cvss 5.5epss 0.01

    The Visual Composer plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 26.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's…

  • CVE-2020-36709MedJun 7, 2023
    WordPress
    Kingcomposer
    risk 0.36cvss 5.5epss 0.01

    The Page Builder: KingComposer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via shortcode in versions before 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web…

  • CVE-2020-36702MedJun 7, 2023
    WordPress
    Ultimate Addons For Gutenberg
    risk 0.36cvss 5.5epss 0.00

    The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber+…

  • CVE-2023-2170MedApr 19, 2023
    Taxopress
    Taxopress
    risk 0.36cvss 5.5epss 0.00

    The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+…

  • CVE-2023-2169MedApr 19, 2023
    Taxopress
    Taxopress
    risk 0.36cvss 5.5epss 0.00

    The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+…

  • CVE-2023-2168MedApr 19, 2023
    Taxopress
    Taxopress
    risk 0.36cvss 5.5epss 0.01

    The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+…

  • CVE-2023-27610MedApr 16, 2023
    Transbank
    Transbank Webpay Rest
    risk 0.36cvss 5.5epss 0.01

    Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions.

  • CVE-2023-23891MedApr 6, 2023
    Oceanwp
    Ocean Extra
    risk 0.36cvss 5.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated.

  • CVE-2023-23898MedApr 6, 2023
    Creativethemes
    Blocksy Companion
    risk 0.36cvss 5.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeThemes Blocksy Companion plugin <= 1.8.67 versions.

  • CVE-2023-1869MedApr 5, 2023
    Plugin
    Yourchannel
    risk 0.36cvss 5.5epss 0.00

    The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level…

  • CVE-2023-24399MedMar 30, 2023
    Oceanwp
    Ocean Extra
    risk 0.36cvss 5.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions.

  • CVE-2023-1575MedMar 29, 2023
    WordPress
    Mega Main Menu
    risk 0.36cvss 5.5epss 0.00

    The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2023-0446MedJan 23, 2023
    WordPress
    My YouTube Channel
    risk 0.36cvss 5.5epss 0.01

    The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2023-0295MedJan 13, 2023
    WordPress
    Launchpad
    risk 0.36cvss 5.5epss 0.01

    The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2023-0162MedJan 10, 2023
    WordPress
    CPO Companion
    risk 0.36cvss 5.5epss 0.01

    The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2023-0087MedJan 5, 2023
    WordPress
    Swifty Page Manager
    risk 0.36cvss 5.5epss 0.01

    The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2022-4663MedJan 3, 2023
    WordPress
    Members Import
    risk 0.36cvss 5.5epss 0.01

    The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to…

  • CVE-2022-4698MedDec 23, 2022
    WordPress
    Profilepress
    risk 0.36cvss 5.5epss 0.01

    The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2022-4697MedDec 23, 2022
    WordPress
    Profilepress
    risk 0.36cvss 5.5epss 0.01

    The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2022-4619MedDec 20, 2022
    WordPress
    Sidebar Widgets By Codelights
    risk 0.36cvss 5.5epss 0.01

    The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2022-4519MedDec 15, 2022
    WordPress
    WP User
    risk 0.36cvss 5.5epss 0.01

    The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2022-4217MedDec 2, 2022
    WordPress
    Chained Quiz
    risk 0.36cvss 5.5epss 0.01

    The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with…

  • CVE-2022-4216MedDec 2, 2022
    WordPress
    Chained Quiz
    risk 0.36cvss 5.5epss 0.01

    The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with…

  • CVE-2022-3897MedNov 29, 2022
    WordPress
    Wp Affiliate Platform
    risk 0.36cvss 5.5epss 0.01

    The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2022-38059MedSep 9, 2022
    WordPress
    Access Code Feeder
    risk 0.36cvss 5.5epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress.

  • CVE-2022-2473MedSep 6, 2022
    WordPress
    WP-UserOnline
    risk 0.36cvss 5.5epss 0.01

    The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in versions up to, and including, 2.87.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2022-2775MedSep 5, 2022
    WordPress
    Fast Flow
    risk 0.36cvss 5.5epss 0.01

    The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…

  • CVE-2022-31475MedJul 21, 2022
    Givewp
    Givewp
    risk 0.36cvss 5.5epss 0.01

    Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

  • CVE-2022-1961MedJun 13, 2022
    WordPress
    Google Tag Manager for WordPress (GTM4WP)
    risk 0.36cvss 5.5epss 0.01

    The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access…

  • CVE-2022-1750MedJun 13, 2022
    WordPress
    Sticky Popup
    risk 0.36cvss 5.5epss 0.01

    The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin…

  • CVE-2022-25607MedMar 18, 2022
    WordPress
    Fv Flowplayer Video Player
    risk 0.36cvss 6.6epss 0.01

    Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).

  • CVE-2021-25026MedMar 14, 2022
    Patreon
    Patreon Wordpress
    risk 0.36cvss 5.5epss 0.01

    The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

  • CVE-2022-21663MedJan 6, 2022
    WordPress
    WordPress
    risk 0.36cvss 6.6epss 0.04

    WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in…

  • CVE-2021-39357MedOct 21, 2021
    WordPress
    Leaky Paywall
    risk 0.36cvss 5.5epss 0.01

    The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the ~/class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including…

  • CVE-2021-39356MedOct 21, 2021
    WordPress
    Content Staging
    risk 0.36cvss 5.5epss 0.01

    The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via several parameters that are echo'd out via the ~/templates/settings.php file which allowed attackers with administrative user access to inject…

  • CVE-2021-39348MedOct 21, 2021
    WordPress
    Learnpress
    risk 0.36cvss 5.5epss 0.05

    The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web…

  • CVE-2021-39328MedOct 21, 2021
    WordPress
    Simple Job Board
    risk 0.36cvss 5.5epss 0.01

    The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with…

  • CVE-2021-39355MedOct 19, 2021
    WordPress
    Indeed Job Importer
    risk 0.36cvss 5.5epss 0.01

    The Indeed Job Importer WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/indeed-job-importer/trunk/indeed-job-importer.php file which allowed attackers with administrative…

  • CVE-2021-39343MedOct 19, 2021
    WordPress
    MPL-Publisher
    risk 0.36cvss 5.5epss 0.01

    The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject…

  • CVE-2021-39329MedOct 19, 2021
    WordPress
    Jobboardwp
    risk 0.36cvss 5.5epss 0.01

    The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-metabox.php file which allowed attackers with administrative user access to inject…

  • CVE-2021-39349MedOct 15, 2021
    WordPress
    Author Bio Box
    risk 0.36cvss 5.5epss 0.01

    The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access…

  • CVE-2021-39345MedOct 15, 2021
    WordPress
    HAL
    risk 0.36cvss 5.5epss 0.01

    The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/wp-hal.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions…

  • CVE-2021-39344MedOct 15, 2021
    WordPress
    KJM Admin Notices
    risk 0.36cvss 5.5epss 0.01

    The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/class-kjm-admin-notices-admin.php file which allowed attackers with administrative user access to…

  • CVE-2021-39338MedOct 15, 2021
    WordPress
    MyBB Cross-Poster
    risk 0.36cvss 5.5epss 0.01

    The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject…

Page 487 of 805