Vendor CVEs
WordPress
All CVEs
39,989 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-24332 | Med | 0.31 | 4.8 | 0.01 | May 24, 2021 | The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues | ||
| CVE-2021-24296 | Med | 0.31 | 4.8 | 0.01 | May 24, 2021 | The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled | ||
| CVE-2021-24327 | Med | 0.31 | 4.8 | 0.01 | May 17, 2021 | The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads | ||
| CVE-2021-24315 | Med | 0.31 | 4.8 | 0.01 | May 17, 2021 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues. | ||
| CVE-2021-24272 | Med | 0.31 | 4.3 | 0.02 | May 5, 2021 | The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the… | ||
| CVE-2021-24134 | Med | 0.31 | 4.8 | 0.01 | Mar 18, 2021 | Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts… | ||
| CVE-2019-19110 | Med | 0.31 | 4.8 | 0.01 | Jun 15, 2020 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. | ||
| CVE-2020-8799 | Med | 0.31 | 4.8 | 0.01 | May 5, 2020 | A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website. | ||
| CVE-2020-11029 | Med | 0.31 | 5.8 | 0.02 | Apr 30, 2020 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release… | ||
| CVE-2020-11028 | Med | 0.31 | 5.8 | 0.02 | Apr 30, 2020 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3,… | ||
| CVE-2020-11025 | Med | 0.31 | 5.8 | 0.02 | Apr 30, 2020 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously… | ||
| CVE-2020-9335 | Med | 0.31 | 4.8 | 0.01 | Feb 25, 2020 | Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users. | ||
| CVE-2019-20182 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2020 | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. | ||
| CVE-2019-20181 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2020 | The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter. | ||
| CVE-2019-16781 | Med | 0.31 | 5.8 | 0.02 | Dec 26, 2019 | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS. | ||
| CVE-2019-16780 | Med | 0.31 | 5.8 | 0.02 | Dec 26, 2019 | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an… | ||
| CVE-2019-16522 | Med | 0.31 | 4.8 | 0.01 | Oct 16, 2019 | The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the… | ||
| CVE-2015-9469 | Med | 0.31 | 4.8 | 0.01 | Oct 10, 2019 | The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id. | ||
| CVE-2019-16524 | Med | 0.31 | 4.8 | 0.01 | Sep 26, 2019 | The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output… | ||
| CVE-2015-9439 | Med | 0.31 | 4.8 | 0.01 | Sep 26, 2019 | The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter. | ||
| CVE-2015-9401 | Med | 0.31 | 4.8 | 0.01 | Sep 20, 2019 | The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. | ||
| CVE-2019-15829 | Med | 0.31 | 4.8 | 0.01 | Aug 30, 2019 | The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. | ||
| CVE-2015-9354 | Med | 0.31 | 4.8 | 0.01 | Aug 28, 2019 | The gigpress plugin before 2.3.11 for WordPress has XSS. | ||
| CVE-2019-14795 | Med | 0.31 | 4.8 | 0.01 | Aug 15, 2019 | The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter. | ||
| CVE-2018-18276 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2019 | XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel. | ||
| CVE-2018-13137 | Med | 0.31 | 4.8 | 0.01 | Apr 12, 2019 | The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI. | ||
| CVE-2018-16204 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2019 | Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-18919 | Med | 0.31 | 4.8 | 0.01 | Nov 4, 2018 | The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area. | ||
| CVE-2018-1000508 | Med | 0.31 | 4.8 | 0.01 | Jun 26, 2018 | WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to… | ||
| CVE-2018-1000172 | Med | 0.31 | 4.8 | 0.01 | Apr 30, 2018 | Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in… | ||
| CVE-2018-10234 | Med | 0.31 | 4.8 | 0.01 | Apr 23, 2018 | Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page. | ||
| CVE-2018-5672 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter. | ||
| CVE-2018-5671 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter. | ||
| CVE-2018-5670 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter. | ||
| CVE-2018-5668 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_title parameter. | ||
| CVE-2018-5667 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_pattern parameter. | ||
| CVE-2018-5666 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter. | ||
| CVE-2018-5665 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter. | ||
| CVE-2018-5664 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter. | ||
| CVE-2018-5663 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter. | ||
| CVE-2018-5662 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter. | ||
| CVE-2018-5661 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter. | ||
| CVE-2018-5660 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter. | ||
| CVE-2018-5659 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter. | ||
| CVE-2018-5657 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter. | ||
| CVE-2018-5652 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter. | ||
| CVE-2018-5651 | Med | 0.31 | 4.8 | 0.01 | Jan 13, 2018 | An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter. | ||
| CVE-2018-5369 | Med | 0.31 | 4.8 | 0.01 | Jan 12, 2018 | The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter. | ||
| CVE-2018-5284 | Med | 0.31 | 4.8 | 0.01 | Jan 8, 2018 | The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php. | ||
| CVE-2015-9230 | Med | 0.31 | 4.8 | 0.02 | Sep 12, 2017 | In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter. |
- risk 0.31cvss 4.8epss 0.01
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
- risk 0.31cvss 4.8epss 0.01
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
- risk 0.31cvss 4.8epss 0.01
The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads
- risk 0.31cvss 4.8epss 0.01
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- risk 0.31cvss 4.3epss 0.02
The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the…
- risk 0.31cvss 4.8epss 0.01
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts…
- risk 0.31cvss 4.8epss 0.01
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.
- risk 0.31cvss 4.8epss 0.01
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website.
- risk 0.31cvss 5.8epss 0.02
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release…
- risk 0.31cvss 5.8epss 0.02
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3,…
- risk 0.31cvss 5.8epss 0.02
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously…
- risk 0.31cvss 4.8epss 0.01
Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.
- risk 0.31cvss 4.8epss 0.01
The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.
- risk 0.31cvss 4.8epss 0.01
The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
- risk 0.31cvss 5.8epss 0.02
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
- risk 0.31cvss 5.8epss 0.02
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an…
- risk 0.31cvss 4.8epss 0.01
The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the…
- risk 0.31cvss 4.8epss 0.01
The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.
- risk 0.31cvss 4.8epss 0.01
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output…
- risk 0.31cvss 4.8epss 0.01
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
- risk 0.31cvss 4.8epss 0.01
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
- risk 0.31cvss 4.8epss 0.01
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
- risk 0.31cvss 4.8epss 0.01
The gigpress plugin before 2.3.11 for WordPress has XSS.
- risk 0.31cvss 4.8epss 0.01
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
- risk 0.31cvss 4.8epss 0.01
XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel.
- risk 0.31cvss 4.8epss 0.01
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.31cvss 4.8epss 0.01
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.
- risk 0.31cvss 4.8epss 0.01
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to…
- risk 0.31cvss 4.8epss 0.01
Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in…
- risk 0.31cvss 4.8epss 0.01
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_title parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_pattern parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter.
- risk 0.31cvss 4.8epss 0.01
The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.
- risk 0.31cvss 4.8epss 0.01
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
- risk 0.31cvss 4.8epss 0.02
In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.
Page 638 of 800