Vendor CVEs

WordPress

All CVEs

40,002 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-3132	WordPress Goolytics	Med	0.31	4.8	0.01	Oct 3, 2022	The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-3128	WordPress Donation Thermometer	Med	0.31	4.8	0.01	Oct 3, 2022	The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-2763	WordPress WP Socializer	Med	0.31	4.8	0.01	Oct 3, 2022	The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-2628	WordPress Dsgvo All In One For Wp	Med	0.31	4.8	0.01	Oct 3, 2022	The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2021-36839	WordPress Social Media Follow Buttons Bar	Med	0.31	4.8	0.01	Sep 30, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.
CVE-2021-36830	WordPress Comment Guestbook	Med	0.31	4.8	0.01	Sep 30, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.
CVE-2022-3135	WordPress SEO Smart Links	Med	0.31	4.8	0.01	Sep 26, 2022	The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3074	WordPress Slider Hero	Med	0.31	4.8	0.01	Sep 26, 2022	The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
CVE-2022-3070	WordPress Generate PDF	Med	0.31	4.8	0.01	Sep 26, 2022	The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-3069	Wordlift Wordlift	Med	0.31	4.8	0.01	Sep 26, 2022	The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-40672	WordPress CPO Shortcodes	Med	0.31	4.8	0.01	Sep 23, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.
CVE-2022-40195	WordPress PCA Predict plugin	Med	0.31	4.8	0.01	Sep 23, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.
CVE-2022-37342	WordPress Add Shortcodes Actions And Filters	Med	0.31	4.8	0.01	Sep 23, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.
CVE-2022-3036	WordPress Gettext override translations	Med	0.31	4.8	0.01	Sep 19, 2022	The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-3021	WordPress Slickr Flickr	Med	0.31	4.8	0.01	Sep 19, 2022	The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2710	Scroll To Top Project Scroll To Top	Med	0.31	4.8	0.01	Sep 19, 2022	The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2709	WordPress Float to Top Button	Med	0.31	4.8	0.01	Sep 19, 2022	The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2567	Codepeople Form Builder Cp	Med	0.31	4.8	0.01	Sep 19, 2022	The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-2887	WordPress Wp Server Health Stats	Med	0.31	4.8	0.01	Sep 16, 2022	The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2799	WordPress Affiliates Manager	Med	0.31	4.8	0.01	Sep 16, 2022	The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2737	Wp Staging Wp Staging	Med	0.31	4.8	0.01	Sep 16, 2022	The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-2635	Autoptimize Autoptimize	Med	0.31	4.8	0.01	Sep 16, 2022	The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-2575	WordPress Currency Switcher For Woocommerce	Med	0.31	4.8	0.01	Sep 16, 2022	The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…
CVE-2022-2351	WordPress Post SMTP Mailer/Email Log	Med	0.31	4.8	0.01	Sep 16, 2022	The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is…
CVE-2022-38068	Apasionados Export Post Info	Med	0.31	4.8	0.01	Sep 9, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
CVE-2022-37412	WordPress Better Delete Revision	Med	0.31	4.8	0.01	Sep 9, 2022	Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at WordPress.
CVE-2022-37404	WordPress add2fav	Med	0.31	4.8	0.01	Sep 9, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress.
CVE-2022-37403	WordPress Add User Role	Med	0.31	4.8	0.01	Sep 9, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress.
CVE-2022-37335	WordPress Word Search Puzzles game	Med	0.31	4.8	0.01	Sep 9, 2022	Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress.
CVE-2022-36356	WordPress Culture Object	Med	0.31	4.8	0.01	Sep 9, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress.
CVE-2022-35725	WordPress wp-forecast	Med	0.31	4.8	0.01	Sep 9, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.
CVE-2022-34656	WordPress Poll, Survey, Questionnaire and Voting system	Med	0.31	4.8	0.01	Sep 6, 2022	Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.
CVE-2021-36829	Mythemeshop Launcher	Med	0.31	4.8	0.01	Sep 6, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 at WordPress.
CVE-2022-2271	WordPress Wp Database Backup	Med	0.31	4.8	0.01	Sep 5, 2022	The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2374	WordPress Simply Schedule Appointments	Med	0.31	4.8	0.01	Aug 29, 2022	The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-36347	WordPress Alpine PhotoTile for Pinterest	Med	0.31	4.8	0.01	Aug 23, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress.
CVE-2022-36282	WordPress Search Exclude	Med	0.31	4.8	0.01	Aug 23, 2022	Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.
CVE-2022-34648	WordPress Uploading SVG, WEBP and ICO files	Med	0.31	4.8	0.01	Aug 23, 2022	Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
CVE-2022-2407	WordPress Wp Phpmyadmin	Med	0.31	4.8	0.01	Aug 22, 2022	The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2361	WordPress WP Social Chat	Med	0.31	4.8	0.01	Aug 22, 2022	The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks.
CVE-2022-1322	WordPress Coming Soon - Under Construction	Med	0.31	4.8	0.01	Aug 22, 2022	The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2022-0446	WordPress Simple Banner	Med	0.31	4.8	0.01	Aug 22, 2022	The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2021-36857	Wpshopmart Testimonial Builder	Med	0.31	4.8	0.01	Aug 22, 2022	Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.
CVE-2021-36847	Webba Booking Webba Booking	Med	0.31	4.8	0.01	Aug 22, 2022	Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.
CVE-2022-2846	WordPress Calendar Event Multi View	Med	0.31	4.3	0.03	Aug 16, 2022	The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create…
CVE-2022-2384	Supsystic Digital Publications By Supsystic	Med	0.31	4.8	0.01	Aug 15, 2022	The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2152	Duplicate Page And Post Project Duplicate Page And Post	Med	0.31	4.8	0.01	Aug 15, 2022	The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2426	Thinkific Thinkific Uploader	Med	0.31	4.8	0.01	Aug 8, 2022	The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.
CVE-2022-2425	WordPress WP DS Blog Map	Med	0.31	4.8	0.01	Aug 8, 2022	The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-2424	WordPress Google Maps Anywhere	Med	0.31	4.8	0.01	Aug 8, 2022	The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in…

CVE-2022-3132MedOct 3, 2022
WordPress
Goolytics
risk 0.31cvss 4.8epss 0.01
The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-3128MedOct 3, 2022
WordPress
Donation Thermometer
risk 0.31cvss 4.8epss 0.01
The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-2763MedOct 3, 2022
WordPress
WP Socializer
risk 0.31cvss 4.8epss 0.01
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-2628MedOct 3, 2022
WordPress
Dsgvo All In One For Wp
risk 0.31cvss 4.8epss 0.01
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2021-36839MedSep 30, 2022
WordPress
Social Media Follow Buttons Bar
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.
CVE-2021-36830MedSep 30, 2022
WordPress
Comment Guestbook
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.
CVE-2022-3135MedSep 26, 2022
WordPress
SEO Smart Links
risk 0.31cvss 4.8epss 0.01
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-3074MedSep 26, 2022
WordPress
Slider Hero
risk 0.31cvss 4.8epss 0.01
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
CVE-2022-3070MedSep 26, 2022
WordPress
Generate PDF
risk 0.31cvss 4.8epss 0.01
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-3069MedSep 26, 2022
Wordlift
Wordlift
risk 0.31cvss 4.8epss 0.01
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-40672MedSep 23, 2022
WordPress
CPO Shortcodes
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.
CVE-2022-40195MedSep 23, 2022
WordPress
PCA Predict plugin
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.
CVE-2022-37342MedSep 23, 2022
WordPress
Add Shortcodes Actions And Filters
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.
CVE-2022-3036MedSep 19, 2022
WordPress
Gettext override translations
risk 0.31cvss 4.8epss 0.01
The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-3021MedSep 19, 2022
WordPress
Slickr Flickr
risk 0.31cvss 4.8epss 0.01
The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2710MedSep 19, 2022
Scroll To Top Project
Scroll To Top
risk 0.31cvss 4.8epss 0.01
The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2709MedSep 19, 2022
WordPress
Float to Top Button
risk 0.31cvss 4.8epss 0.01
The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2567MedSep 19, 2022
Codepeople
Form Builder Cp
risk 0.31cvss 4.8epss 0.01
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
CVE-2022-2887MedSep 16, 2022
WordPress
Wp Server Health Stats
risk 0.31cvss 4.8epss 0.01
The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2799MedSep 16, 2022
WordPress
Affiliates Manager
risk 0.31cvss 4.8epss 0.01
The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2737MedSep 16, 2022
Wp Staging
Wp Staging
risk 0.31cvss 4.8epss 0.01
The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-2635MedSep 16, 2022
Autoptimize
Autoptimize
risk 0.31cvss 4.8epss 0.01
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-2575MedSep 16, 2022
WordPress
Currency Switcher For Woocommerce
risk 0.31cvss 4.8epss 0.01
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…
CVE-2022-2351MedSep 16, 2022
WordPress
Post SMTP Mailer/Email Log
risk 0.31cvss 4.8epss 0.01
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is…
CVE-2022-38068MedSep 9, 2022
Apasionados
Export Post Info
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
CVE-2022-37412MedSep 9, 2022
WordPress
Better Delete Revision
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at WordPress.
CVE-2022-37404MedSep 9, 2022
WordPress
add2fav
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress.
CVE-2022-37403MedSep 9, 2022
WordPress
Add User Role
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress.
CVE-2022-37335MedSep 9, 2022
WordPress
Word Search Puzzles game
risk 0.31cvss 4.8epss 0.01
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress.
CVE-2022-36356MedSep 9, 2022
WordPress
Culture Object
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress.
CVE-2022-35725MedSep 9, 2022
WordPress
wp-forecast
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.
CVE-2022-34656MedSep 6, 2022
WordPress
Poll, Survey, Questionnaire and Voting system
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.
CVE-2021-36829MedSep 6, 2022
Mythemeshop
Launcher
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 at WordPress.
CVE-2022-2271MedSep 5, 2022
WordPress
Wp Database Backup
risk 0.31cvss 4.8epss 0.01
The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2374MedAug 29, 2022
WordPress
Simply Schedule Appointments
risk 0.31cvss 4.8epss 0.01
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
CVE-2022-36347MedAug 23, 2022
WordPress
Alpine PhotoTile for Pinterest
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress.
CVE-2022-36282MedAug 23, 2022
WordPress
Search Exclude
risk 0.31cvss 4.8epss 0.01
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.
CVE-2022-34648MedAug 23, 2022
WordPress
Uploading SVG, WEBP and ICO files
risk 0.31cvss 4.8epss 0.01
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
CVE-2022-2407MedAug 22, 2022
WordPress
Wp Phpmyadmin
risk 0.31cvss 4.8epss 0.01
The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2361MedAug 22, 2022
WordPress
WP Social Chat
risk 0.31cvss 4.8epss 0.01
The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks.
CVE-2022-1322MedAug 22, 2022
WordPress
Coming Soon - Under Construction
risk 0.31cvss 4.8epss 0.01
The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2022-0446MedAug 22, 2022
WordPress
Simple Banner
risk 0.31cvss 4.8epss 0.01
The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2021-36857MedAug 22, 2022
Wpshopmart
Testimonial Builder
risk 0.31cvss 4.8epss 0.01
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.
CVE-2021-36847MedAug 22, 2022
Webba Booking
Webba Booking
risk 0.31cvss 4.8epss 0.01
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.
CVE-2022-2846MedAug 16, 2022
WordPress
Calendar Event Multi View
risk 0.31cvss 4.3epss 0.03
The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create…
CVE-2022-2384MedAug 15, 2022
Supsystic
Digital Publications By Supsystic
risk 0.31cvss 4.8epss 0.01
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2152MedAug 15, 2022
Duplicate Page And Post Project
Duplicate Page And Post
risk 0.31cvss 4.8epss 0.01
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2426MedAug 8, 2022
Thinkific
Thinkific Uploader
risk 0.31cvss 4.8epss 0.01
The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.
CVE-2022-2425MedAug 8, 2022
WordPress
WP DS Blog Map
risk 0.31cvss 4.8epss 0.01
The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite…
CVE-2022-2424MedAug 8, 2022
WordPress
Google Maps Anywhere
risk 0.31cvss 4.8epss 0.01
The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in…

Page 632 of 801