Total
37705 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-2278 | 1 Themify | 1 Woocommerce Product Filter | 2025-05-07 | N/A | 6.1 MEDIUM |
| Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2024-1274 | 1 Joedolson | 1 My Calendar | 2025-05-07 | N/A | 5.4 MEDIUM |
| The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin) | |||||
| CVE-2024-10704 | 1 10web | 1 Photo Gallery | 2025-05-07 | N/A | 4.8 MEDIUM |
| The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10980 | 1 Bdthemes | 1 Element Pack | 2025-05-07 | N/A | 5.4 MEDIUM |
| The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2024-10551 | 1 Sanil | 1 Sticky Social Icons | 2025-05-07 | N/A | 4.8 MEDIUM |
| The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-11183 | 1 Rumspeed | 1 Simple Side Tab | 2025-05-06 | N/A | 4.8 MEDIUM |
| The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-9651 | 1 Fluentforms | 1 Contact Form | 2025-05-06 | N/A | 6.1 MEDIUM |
| The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-45986 | 1 Projectworlds | 1 Online Voting System Project | 2025-05-06 | N/A | 5.4 MEDIUM |
| A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is registered with a malicious javascript payload. The payload is stored and subsequently executed in the voter.php and profile.php pages whenever the account information is accessed. | |||||
| CVE-2023-6081 | 1 Chartjs Project | 1 Chartjs | 2025-05-06 | N/A | 5.4 MEDIUM |
| The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-3420 | 1 Official Integration For Billingo Project | 1 Official Integration For Billingo | 2025-05-06 | N/A | 4.8 MEDIUM |
| The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2022-3408 | 1 Redlettuce | 1 Wp Word Count | 2025-05-06 | N/A | 4.8 MEDIUM |
| The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. | |||||
| CVE-2024-45967 | 1 Pagekit | 1 Pagekit | 2025-05-06 | N/A | 4.7 MEDIUM |
| Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. | |||||
| CVE-2024-28150 | 1 Jenkins | 1 Html Publisher | 2025-05-06 | N/A | 4.7 MEDIUM |
| Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2024-28149 | 1 Jenkins | 1 Html Publisher | 2025-05-06 | N/A | 6.5 MEDIUM |
| Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists. | |||||
| CVE-2022-40290 | 1 Phppointofsale | 1 Php Point Of Sale | 2025-05-06 | N/A | 6.1 MEDIUM |
| The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing attackers to generate an unsafe link that could compromise users. | |||||
| CVE-2022-40289 | 1 Phppointofsale | 1 Php Point Of Sale | 2025-05-06 | N/A | 9.0 CRITICAL |
| The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files. | |||||
| CVE-2022-40288 | 1 Phppointofsale | 1 Php Point Of Sale | 2025-05-06 | N/A | 9.0 CRITICAL |
| The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile. | |||||
| CVE-2022-40287 | 1 Phppointofsale | 1 Php Point Of Sale | 2025-05-06 | N/A | 9.0 CRITICAL |
| The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account. | |||||
| CVE-2022-3441 | 1 Rockcontent | 1 Rock Convert | 2025-05-06 | N/A | 4.8 MEDIUM |
| The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-3440 | 1 Rockcontent | 1 Rock Convert | 2025-05-06 | N/A | 6.1 MEDIUM |
| The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting | |||||