Vendor CVEs

WordPress

All CVEs

40,013 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2023-5530	WordPress Ninja Forms Contact Form	Med	0.31	4.8	0.01	Nov 6, 2023	The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are…
CVE-2023-5228	WordPress User Registration	Med	0.31	4.8	0.01	Nov 6, 2023	The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-5181	WordPress Wp Discord Invite	Med	0.31	4.8	0.00	Nov 6, 2023	The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-4858	WordPress Simple Table Manager	Med	0.31	4.8	0.00	Nov 6, 2023	The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-4810	Wpdarko Responsive Pricing Table	Med	0.31	4.8	0.00	Nov 6, 2023	The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example…
CVE-2023-5243	WordPress Login Screen Manager	Med	0.31	4.8	0.00	Oct 31, 2023	The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-5229	WordPress E2pdf	Med	0.31	4.8	0.00	Oct 31, 2023	The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2023-4390	WordPress Popup Box	Med	0.31	4.8	0.00	Oct 31, 2023	The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
CVE-2023-4862	WordPress File Manager Pro	Med	0.31	4.8	0.00	Oct 16, 2023	The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
CVE-2023-4725	WordPress Simple Posts Ticker	Med	0.31	4.8	0.00	Oct 16, 2023	The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-4388	WordPress Eventon	Med	0.31	4.8	0.00	Oct 16, 2023	The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-4502	Gtranslate Translate Wordpress With Gtranslate	Med	0.31	4.8	0.00	Sep 25, 2023	The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…
CVE-2023-3226	WordPress Popup Builder	Med	0.31	4.8	0.00	Sep 25, 2023	The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-4376	WordPress Serial Codes Generator and Validator with WooCommerce Support	Med	0.31	4.8	0.00	Sep 19, 2023	The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html…
CVE-2023-2995	WordPress Leyka	Med	0.31	4.8	0.00	Sep 19, 2023	The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-4060	WordPress WP Adminify	Med	0.31	4.8	0.00	Sep 11, 2023	The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-4022	WordPress Herd Effects	Med	0.31	4.8	0.00	Sep 11, 2023	The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3170	Tagdiv Composer	Med	0.31	4.8	0.00	Sep 11, 2023	The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the…
CVE-2023-4298	123.chat 123.chat	Med	0.31	4.8	0.00	Sep 4, 2023	The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-4254	WordPress AI ChatBot	Med	0.31	4.8	0.00	Sep 4, 2023	The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-4253	WordPress AI ChatBot	Med	0.31	4.8	0.00	Sep 4, 2023	The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3499	WordPress Rbs Image Gallery	Med	0.31	4.8	0.00	Sep 4, 2023	The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability…
CVE-2023-4500	WordPress Order Tracking Pro	Med	0.31	4.7	0.00	Aug 31, 2023	The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin…
CVE-2023-4109	WordPress Ninja Forms Contact Form	Med	0.31	4.8	0.00	Aug 30, 2023	The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
CVE-2023-3501	WordPress Formcraft	Med	0.31	4.8	0.00	Aug 30, 2023	The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-1982	WordPress Front Editor	Med	0.31	4.8	0.00	Aug 30, 2023	The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-3667	WordPress Bit Assist	Med	0.31	4.8	0.00	Aug 21, 2023	The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-2254	WordPress Ko Fi Button	Med	0.31	4.8	0.00	Aug 16, 2023	The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we…
CVE-2023-2225	WordPress SEO Alert	Med	0.31	4.8	0.00	Aug 16, 2023	The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3721	WordPress WP-EMail	Med	0.31	4.8	0.00	Aug 14, 2023	The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3645	WordPress Contact Form Builder By Bit Form	Med	0.31	4.8	0.00	Aug 14, 2023	The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2023-3328	WordPress Custom Field For Wp Job Manager	Med	0.31	4.8	0.00	Aug 14, 2023	The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2023-2802	WordPress Ultimate Addons For Contact Form 7	Med	0.31	4.8	0.00	Aug 14, 2023	The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…
CVE-2023-2606	Brutalplugins Wp Brutal AI	Med	0.31	4.8	0.02	Aug 14, 2023	The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-44629	Catalystconnect Catalyst Connect Zoho CRM Client Portal	Med	0.31	4.8	0.00	Aug 10, 2023	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.
CVE-2022-27861	arscode Ninja Popups	Med	0.31	4.7	0.00	Aug 10, 2023	Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions.
CVE-2023-3650	WordPress Bubble Menu	Med	0.31	4.8	0.01	Aug 7, 2023	The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite…
CVE-2023-3130	WordPress Short URL	Med	0.31	4.8	0.01	Jul 31, 2023	The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3344	WordPress Auto Location For Wp Job Manager Via Google	Med	0.31	4.8	0.00	Jul 24, 2023	The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
CVE-2023-3248	WordPress All-in-one Floating Contact Form	Med	0.31	4.8	0.00	Jul 24, 2023	The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2023-3245	WordPress Floating Chat Widget	Med	0.31	4.8	0.00	Jul 17, 2023	The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-3225	WordPress Float Menu	Med	0.31	4.8	0.01	Jul 10, 2023	The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3175	WordPress AI ChatBot	Med	0.31	4.8	0.01	Jul 10, 2023	The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2023-3129	Kaizencoders URL Shortify	Med	0.31	4.8	0.01	Jul 10, 2023	The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-2967	WordPress TinyMCE Custom Styles	Med	0.31	4.8	0.01	Jul 10, 2023	The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-2709	WordPress AN_GradeBook	Med	0.31	4.8	0.01	Jul 10, 2023	The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-2635	WordPress Call Now Accessibility Button	Med	0.31	4.8	0.01	Jul 10, 2023	The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2023-2578	Buymeacoffee Buy Me A Coffee	Med	0.31	4.8	0.00	Jul 10, 2023	The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-2029	WordPress PrePost SEO	Med	0.31	4.8	0.01	Jul 10, 2023	The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-2028	WordPress Call Now Accessibility Button	Med	0.31	4.8	0.01	Jul 10, 2023	The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in…

CVE-2023-5530MedNov 6, 2023
WordPress
Ninja Forms Contact Form
risk 0.31cvss 4.8epss 0.01
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are…
CVE-2023-5228MedNov 6, 2023
WordPress
User Registration
risk 0.31cvss 4.8epss 0.01
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-5181MedNov 6, 2023
WordPress
Wp Discord Invite
risk 0.31cvss 4.8epss 0.00
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-4858MedNov 6, 2023
WordPress
Simple Table Manager
risk 0.31cvss 4.8epss 0.00
The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-4810MedNov 6, 2023
Wpdarko
Responsive Pricing Table
risk 0.31cvss 4.8epss 0.00
The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example…
CVE-2023-5243MedOct 31, 2023
WordPress
Login Screen Manager
risk 0.31cvss 4.8epss 0.00
The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-5229MedOct 31, 2023
WordPress
E2pdf
risk 0.31cvss 4.8epss 0.00
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2023-4390MedOct 31, 2023
WordPress
Popup Box
risk 0.31cvss 4.8epss 0.00
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
CVE-2023-4862MedOct 16, 2023
WordPress
File Manager Pro
risk 0.31cvss 4.8epss 0.00
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
CVE-2023-4725MedOct 16, 2023
WordPress
Simple Posts Ticker
risk 0.31cvss 4.8epss 0.00
The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-4388MedOct 16, 2023
WordPress
Eventon
risk 0.31cvss 4.8epss 0.00
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-4502MedSep 25, 2023
Gtranslate
Translate Wordpress With Gtranslate
risk 0.31cvss 4.8epss 0.00
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…
CVE-2023-3226MedSep 25, 2023
WordPress
Popup Builder
risk 0.31cvss 4.8epss 0.00
The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-4376MedSep 19, 2023
WordPress
Serial Codes Generator and Validator with WooCommerce Support
risk 0.31cvss 4.8epss 0.00
The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html…
CVE-2023-2995MedSep 19, 2023
WordPress
Leyka
risk 0.31cvss 4.8epss 0.00
The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-4060MedSep 11, 2023
WordPress
WP Adminify
risk 0.31cvss 4.8epss 0.00
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-4022MedSep 11, 2023
WordPress
Herd Effects
risk 0.31cvss 4.8epss 0.00
The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3170MedSep 11, 2023
Tagdiv
Composer
risk 0.31cvss 4.8epss 0.00
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the…
CVE-2023-4298MedSep 4, 2023
123.chat
123.chat
risk 0.31cvss 4.8epss 0.00
The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-4254MedSep 4, 2023
WordPress
AI ChatBot
risk 0.31cvss 4.8epss 0.00
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-4253MedSep 4, 2023
WordPress
AI ChatBot
risk 0.31cvss 4.8epss 0.00
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3499MedSep 4, 2023
WordPress
Rbs Image Gallery
risk 0.31cvss 4.8epss 0.00
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability…
CVE-2023-4500MedAug 31, 2023
WordPress
Order Tracking Pro
risk 0.31cvss 4.7epss 0.00
The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin…
CVE-2023-4109MedAug 30, 2023
WordPress
Ninja Forms Contact Form
risk 0.31cvss 4.8epss 0.00
The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
CVE-2023-3501MedAug 30, 2023
WordPress
Formcraft
risk 0.31cvss 4.8epss 0.00
The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-1982MedAug 30, 2023
WordPress
Front Editor
risk 0.31cvss 4.8epss 0.00
The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-3667MedAug 21, 2023
WordPress
Bit Assist
risk 0.31cvss 4.8epss 0.00
The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-2254MedAug 16, 2023
WordPress
Ko Fi Button
risk 0.31cvss 4.8epss 0.00
The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we…
CVE-2023-2225MedAug 16, 2023
WordPress
SEO Alert
risk 0.31cvss 4.8epss 0.00
The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3721MedAug 14, 2023
WordPress
WP-EMail
risk 0.31cvss 4.8epss 0.00
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3645MedAug 14, 2023
WordPress
Contact Form Builder By Bit Form
risk 0.31cvss 4.8epss 0.00
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2023-3328MedAug 14, 2023
WordPress
Custom Field For Wp Job Manager
risk 0.31cvss 4.8epss 0.00
The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2023-2802MedAug 14, 2023
WordPress
Ultimate Addons For Contact Form 7
risk 0.31cvss 4.8epss 0.00
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…
CVE-2023-2606MedAug 14, 2023
Brutalplugins
Wp Brutal AI
risk 0.31cvss 4.8epss 0.02
The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-44629MedAug 10, 2023
Catalystconnect
Catalyst Connect Zoho CRM Client Portal
risk 0.31cvss 4.8epss 0.00
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.
CVE-2022-27861MedAug 10, 2023
arscode
Ninja Popups
risk 0.31cvss 4.7epss 0.00
Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions.
CVE-2023-3650MedAug 7, 2023
WordPress
Bubble Menu
risk 0.31cvss 4.8epss 0.01
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite…
CVE-2023-3130MedJul 31, 2023
WordPress
Short URL
risk 0.31cvss 4.8epss 0.01
The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3344MedJul 24, 2023
WordPress
Auto Location For Wp Job Manager Via Google
risk 0.31cvss 4.8epss 0.00
The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
CVE-2023-3248MedJul 24, 2023
WordPress
All-in-one Floating Contact Form
risk 0.31cvss 4.8epss 0.00
The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2023-3245MedJul 17, 2023
WordPress
Floating Chat Widget
risk 0.31cvss 4.8epss 0.00
The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-3225MedJul 10, 2023
WordPress
Float Menu
risk 0.31cvss 4.8epss 0.01
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-3175MedJul 10, 2023
WordPress
AI ChatBot
risk 0.31cvss 4.8epss 0.01
The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2023-3129MedJul 10, 2023
Kaizencoders
URL Shortify
risk 0.31cvss 4.8epss 0.01
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-2967MedJul 10, 2023
WordPress
TinyMCE Custom Styles
risk 0.31cvss 4.8epss 0.01
The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-2709MedJul 10, 2023
WordPress
AN_GradeBook
risk 0.31cvss 4.8epss 0.01
The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-2635MedJul 10, 2023
WordPress
Call Now Accessibility Button
risk 0.31cvss 4.8epss 0.01
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2023-2578MedJul 10, 2023
Buymeacoffee
Buy Me A Coffee
risk 0.31cvss 4.8epss 0.00
The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-2029MedJul 10, 2023
WordPress
PrePost SEO
risk 0.31cvss 4.8epss 0.01
The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-2028MedJul 10, 2023
WordPress
Call Now Accessibility Button
risk 0.31cvss 4.8epss 0.01
The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in…

Page 628 of 801