Total
36508 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-2141 | 1 Brainstormforce | 1 Ultimate Addons For Beaver Builder | 2025-01-30 | N/A | 6.4 MEDIUM |
| The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-2140 | 1 Brainstormforce | 1 Ultimate Addons For Beaver Builder | 2025-01-30 | N/A | 6.4 MEDIUM |
| The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Icons widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-0871 | 2025-01-30 | 4.0 MEDIUM | 3.5 LOW | ||
| A vulnerability classified as problematic has been found in Maybecms 1.2. This affects an unknown part of the file /mb/admin/index.php?u=article-edit of the component Add Article. The manipulation of the argument data_info[content] leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2023-1861 | 1 Limit Login Attempts Project | 1 Limit Login Attempts | 2025-01-30 | N/A | 5.4 MEDIUM |
| The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2023-1805 | 1 Pixelyoursite | 1 Product Catalog Feed | 2025-01-30 | N/A | 6.1 MEDIUM |
| The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2023-1804 | 1 Pixelyoursite | 1 Product Catalog Feed | 2025-01-30 | N/A | 6.1 MEDIUM |
| The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators. | |||||
| CVE-2023-1614 | 1 Wp Custom Author Url Project | 1 Wp Custom Author Url | 2025-01-30 | N/A | 4.8 MEDIUM |
| The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2023-1554 | 1 Fullworksplugins | 1 Quick Paypal Payments | 2025-01-30 | N/A | 4.8 MEDIUM |
| The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-1546 | 1 Plainviewplugins | 1 Mycryptocheckout | 2025-01-30 | N/A | 6.1 MEDIUM |
| The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting | |||||
| CVE-2023-1525 | 1 Geminilabs | 1 Site Reviews | 2025-01-30 | N/A | 4.8 MEDIUM |
| The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2023-1090 | 1 Smtp Mailing Queue Project | 1 Smtp Mailing Queue | 2025-01-30 | N/A | 4.8 MEDIUM |
| The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-1021 | 1 Amr-ical-events-list Project | 1 Amr-ical-events-list | 2025-01-30 | N/A | 4.8 MEDIUM |
| The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-0891 | 1 Codestag | 1 Stagtools | 2025-01-30 | N/A | 5.4 MEDIUM |
| The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2024-9672 | 1 Papercut | 2 Papercut Mf, Papercut Ng | 2025-01-30 | N/A | 5.4 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur. | |||||
| CVE-2025-0746 | 2025-01-30 | N/A | 6.1 MEDIUM | ||
| A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the"/embedai/users/show/<SCRIPT>" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed when a user opens the malicious URL. | |||||
| CVE-2024-12524 | 2025-01-30 | N/A | 6.4 MEDIUM | ||
| The Clinked Client Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-12921 | 2025-01-30 | N/A | 6.4 MEDIUM | ||
| The EthereumICO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ethereum-ico shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-24744 | 1 Rediker | 1 Adminplus | 2025-01-29 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onload function within the application DOM. | |||||
| CVE-2024-2619 | 1 Brainstormforce | 1 Elementor Header \& Footer Builder | 2025-01-29 | N/A | 5.0 MEDIUM |
| The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary HTML in pages that will be shown whenever a user accesses an injected page. | |||||
| CVE-2024-3134 | 1 Master-addons | 1 Master Addons | 2025-01-29 | N/A | 6.4 MEDIUM |
| The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||