Vendor CVEs

WordPress

All CVEs

40,004 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-34148	Jetbackup Jetbackup	Med	0.31	4.8	0.00	Mar 15, 2023	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.
CVE-2023-0844	WordPress Namaste Lms	Med	0.31	4.8	0.00	Mar 13, 2023	The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-1112	WordPress Drag And Drop Multiple File Upload Contact Form 7	Med	0.31	4.7	0.03	Mar 1, 2023	A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It…
CVE-2023-0548	WordPress Namaste Lms	Med	0.31	4.8	0.01	Feb 27, 2023	The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-0543	WordPress Arigato Autoresponder and Newsletter	Med	0.31	4.8	0.00	Feb 27, 2023	The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2023-0429	WordPress Watu Quiz	Med	0.31	4.8	0.00	Feb 21, 2023	The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-29416	Afterpay Afterpay Gateway For Woocommerce	Med	0.31	4.7	0.00	Feb 6, 2023	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Afterpay Gateway for WooCommerce <= 3.5.0 versions.
CVE-2022-27628	Wzone Project Wzone	Med	0.31	4.7	0.00	Feb 6, 2023	Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions.
CVE-2022-2546	WordPress All In One Wp Migration	Med	0.31	4.7	0.01	Feb 2, 2023	The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript…
CVE-2022-3811	WordPress EU Cookie Law for GDPR/CCPA	Med	0.31	4.8	0.00	Jan 23, 2023	The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-40697	WordPress 3com – Asesor de Cookies para normativa española	Med	0.31	4.8	0.00	Jan 19, 2023	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions.
CVE-2022-42462	WordPress IP Blacklist Cloud	Med	0.31	4.8	0.00	Jan 17, 2023	Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions.
CVE-2022-4442	WordPress Custom Post Types and Custom Fields creator	Med	0.31	4.8	0.00	Jan 16, 2023	The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
CVE-2022-4330	WordPress Wp Attachments	Med	0.31	4.8	0.00	Jan 16, 2023	The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4299	Metricool Metricool	Med	0.31	4.8	0.00	Jan 16, 2023	The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4199	WordPress Link Library	Med	0.31	4.8	0.00	Jan 16, 2023	The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-2658	WordPress Wp Spell Check	Med	0.31	4.8	0.00	Jan 16, 2023	The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-4196	WordPress Multi Step Form	Med	0.31	4.8	0.00	Jan 9, 2023	The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3855	WordPress 404 To Start	Med	0.31	4.8	0.01	Jan 9, 2023	The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4260	WordPress WP-Ban	Med	0.31	4.8	0.01	Jan 2, 2023	The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4256	WordPress All In One Addons For Elementor	Med	0.31	4.8	0.00	Jan 2, 2023	The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-4200	WordPress Login with Cognito	Med	0.31	4.8	0.01	Jan 2, 2023	The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4198	WordPress Wp Social Sharing	Med	0.31	4.8	0.01	Jan 2, 2023	The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4142	WordPress Filter Gallery Plugin	Med	0.31	4.8	0.00	Jan 2, 2023	The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the…
CVE-2022-4119	WordPress Image Optimizer, Resizer and CDN	Med	0.31	4.8	0.00	Jan 2, 2023	The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-3936	WordPress Team Members	Med	0.31	4.8	0.01	Jan 2, 2023	The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a…
CVE-2022-3922	WordPress Broken Link Checker	Med	0.31	4.8	0.01	Dec 28, 2022	The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4243	WordPress Imageinject	Med	0.31	4.8	0.01	Dec 26, 2022	The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4242	WordPress WP Google Review Slider	Med	0.31	4.8	0.01	Dec 26, 2022	The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4226	WordPress Simple Basic Contact Form	Med	0.31	4.8	0.01	Dec 26, 2022	The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-4197	WordPress Slider 10web	Med	0.31	4.8	0.01	Dec 26, 2022	The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4110	WordPress Eventify	Med	0.31	4.8	0.01	Dec 26, 2022	The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4042	WordPress Paytium: Mollie payment forms & donations	Med	0.31	4.8	0.00	Dec 26, 2022	The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
CVE-2022-3840	WordPress Login for Google Apps	Med	0.31	4.8	0.01	Dec 26, 2022	The Login for Google Apps WordPress plugin before 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3835	WordPress Kwayy HTML Sitemap	Med	0.31	4.8	0.01	Dec 26, 2022	The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4112	WordPress Quizlord	Med	0.31	4.8	0.01	Dec 19, 2022	The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-3832	WordPress External Media	Med	0.31	4.8	0.00	Dec 19, 2022	The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4010	WordPress Image Hover Effects	Med	0.31	4.8	0.01	Dec 12, 2022	The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4000	WordPress WooCommerce Shipping	Med	0.31	4.8	0.00	Dec 12, 2022	The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3919	WordPress Jetpack CRM	Med	0.31	4.8	0.00	Dec 12, 2022	The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-3906	WordPress Easy Form Builder	Med	0.31	4.8	0.00	Dec 12, 2022	The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3862	WordPress Livemesh Addons for Elementor	Med	0.31	4.8	0.00	Dec 12, 2022	The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-3609	WordPress GetYourGuide Ticketing	Med	0.31	4.8	0.00	Dec 12, 2022	The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-45816	WordPress Gd Bbpress Attachments	Med	0.31	4.8	0.00	Dec 6, 2022	Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress.
CVE-2022-3909	WordPress Add Comments	Med	0.31	4.8	0.01	Dec 5, 2022	The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-3892	Wp OAuth Wp OAuth Server	Med	0.31	4.8	0.01	Dec 5, 2022	The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-3838	WordPress Wpupper Share Buttons	Med	0.31	4.8	0.00	Dec 5, 2022	The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3837	WordPress Uji Countdown	Med	0.31	4.8	0.00	Dec 5, 2022	The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-3830	WordPress WP Page Builder	Med	0.31	4.8	0.00	Dec 5, 2022	The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3426	WordPress Advanced WP Columns	Med	0.31	4.8	0.01	Dec 5, 2022	The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…

CVE-2022-34148MedMar 15, 2023
Jetbackup
Jetbackup
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.
CVE-2023-0844MedMar 13, 2023
WordPress
Namaste Lms
risk 0.31cvss 4.8epss 0.00
The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2023-1112MedMar 1, 2023
WordPress
Drag And Drop Multiple File Upload Contact Form 7
risk 0.31cvss 4.7epss 0.03
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It…
CVE-2023-0548MedFeb 27, 2023
WordPress
Namaste Lms
risk 0.31cvss 4.8epss 0.01
The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2023-0543MedFeb 27, 2023
WordPress
Arigato Autoresponder and Newsletter
risk 0.31cvss 4.8epss 0.00
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2023-0429MedFeb 21, 2023
WordPress
Watu Quiz
risk 0.31cvss 4.8epss 0.00
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-29416MedFeb 6, 2023
Afterpay
Afterpay Gateway For Woocommerce
risk 0.31cvss 4.7epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Afterpay Gateway for WooCommerce <= 3.5.0 versions.
CVE-2022-27628MedFeb 6, 2023
Wzone Project
Wzone
risk 0.31cvss 4.7epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions.
CVE-2022-2546MedFeb 2, 2023
WordPress
All In One Wp Migration
risk 0.31cvss 4.7epss 0.01
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript…
CVE-2022-3811MedJan 23, 2023
WordPress
EU Cookie Law for GDPR/CCPA
risk 0.31cvss 4.8epss 0.00
The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-40697MedJan 19, 2023
WordPress
3com – Asesor de Cookies para normativa española
risk 0.31cvss 4.8epss 0.00
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions.
CVE-2022-42462MedJan 17, 2023
WordPress
IP Blacklist Cloud
risk 0.31cvss 4.8epss 0.00
Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions.
CVE-2022-4442MedJan 16, 2023
WordPress
Custom Post Types and Custom Fields creator
risk 0.31cvss 4.8epss 0.00
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
CVE-2022-4330MedJan 16, 2023
WordPress
Wp Attachments
risk 0.31cvss 4.8epss 0.00
The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4299MedJan 16, 2023
Metricool
Metricool
risk 0.31cvss 4.8epss 0.00
The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4199MedJan 16, 2023
WordPress
Link Library
risk 0.31cvss 4.8epss 0.00
The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-2658MedJan 16, 2023
WordPress
Wp Spell Check
risk 0.31cvss 4.8epss 0.00
The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-4196MedJan 9, 2023
WordPress
Multi Step Form
risk 0.31cvss 4.8epss 0.00
The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3855MedJan 9, 2023
WordPress
404 To Start
risk 0.31cvss 4.8epss 0.01
The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4260MedJan 2, 2023
WordPress
WP-Ban
risk 0.31cvss 4.8epss 0.01
The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4256MedJan 2, 2023
WordPress
All In One Addons For Elementor
risk 0.31cvss 4.8epss 0.00
The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-4200MedJan 2, 2023
WordPress
Login with Cognito
risk 0.31cvss 4.8epss 0.01
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4198MedJan 2, 2023
WordPress
Wp Social Sharing
risk 0.31cvss 4.8epss 0.01
The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4142MedJan 2, 2023
WordPress
Filter Gallery Plugin
risk 0.31cvss 4.8epss 0.00
The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the…
CVE-2022-4119MedJan 2, 2023
WordPress
Image Optimizer, Resizer and CDN
risk 0.31cvss 4.8epss 0.00
The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-3936MedJan 2, 2023
WordPress
Team Members
risk 0.31cvss 4.8epss 0.01
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a…
CVE-2022-3922MedDec 28, 2022
WordPress
Broken Link Checker
risk 0.31cvss 4.8epss 0.01
The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4243MedDec 26, 2022
WordPress
Imageinject
risk 0.31cvss 4.8epss 0.01
The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4242MedDec 26, 2022
WordPress
WP Google Review Slider
risk 0.31cvss 4.8epss 0.01
The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4226MedDec 26, 2022
WordPress
Simple Basic Contact Form
risk 0.31cvss 4.8epss 0.01
The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-4197MedDec 26, 2022
WordPress
Slider 10web
risk 0.31cvss 4.8epss 0.01
The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4110MedDec 26, 2022
WordPress
Eventify
risk 0.31cvss 4.8epss 0.01
The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-4042MedDec 26, 2022
WordPress
Paytium: Mollie payment forms & donations
risk 0.31cvss 4.8epss 0.00
The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
CVE-2022-3840MedDec 26, 2022
WordPress
Login for Google Apps
risk 0.31cvss 4.8epss 0.01
The Login for Google Apps WordPress plugin before 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3835MedDec 26, 2022
WordPress
Kwayy HTML Sitemap
risk 0.31cvss 4.8epss 0.01
The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4112MedDec 19, 2022
WordPress
Quizlord
risk 0.31cvss 4.8epss 0.01
The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-3832MedDec 19, 2022
WordPress
External Media
risk 0.31cvss 4.8epss 0.00
The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4010MedDec 12, 2022
WordPress
Image Hover Effects
risk 0.31cvss 4.8epss 0.01
The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-4000MedDec 12, 2022
WordPress
WooCommerce Shipping
risk 0.31cvss 4.8epss 0.00
The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3919MedDec 12, 2022
WordPress
Jetpack CRM
risk 0.31cvss 4.8epss 0.00
The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-3906MedDec 12, 2022
WordPress
Easy Form Builder
risk 0.31cvss 4.8epss 0.00
The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3862MedDec 12, 2022
WordPress
Livemesh Addons for Elementor
risk 0.31cvss 4.8epss 0.00
The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-3609MedDec 12, 2022
WordPress
GetYourGuide Ticketing
risk 0.31cvss 4.8epss 0.00
The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-45816MedDec 6, 2022
WordPress
Gd Bbpress Attachments
risk 0.31cvss 4.8epss 0.00
Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress.
CVE-2022-3909MedDec 5, 2022
WordPress
Add Comments
risk 0.31cvss 4.8epss 0.01
The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-3892MedDec 5, 2022
Wp OAuth
Wp OAuth Server
risk 0.31cvss 4.8epss 0.01
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-3838MedDec 5, 2022
WordPress
Wpupper Share Buttons
risk 0.31cvss 4.8epss 0.00
The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3837MedDec 5, 2022
WordPress
Uji Countdown
risk 0.31cvss 4.8epss 0.00
The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-3830MedDec 5, 2022
WordPress
WP Page Builder
risk 0.31cvss 4.8epss 0.00
The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3426MedDec 5, 2022
WordPress
Advanced WP Columns
risk 0.31cvss 4.8epss 0.01
The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…

Page 630 of 801