Vulnerabilities (CVE)

Filtered by CWE-79
Total 36870 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-12400 1 Goodlayers 1 Tour Master 2025-06-09 N/A 7.1 HIGH
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
CVE-2024-12163 1 Goodlayers 1 Goodlayers Core 2025-06-09 N/A 6.5 MEDIUM
The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads.
CVE-2024-10510 1 Netfunkdesign 1 Adbuddy\+ \(adblocker Detection\) 2025-06-09 N/A 4.8 MEDIUM
The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2023-6163 1 Themeum 1 Wp Crowdfunding 2025-06-09 N/A 4.8 MEDIUM
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-5956 1 Markusbegerow 1 Wp-adv-quiz 2025-06-09 N/A 4.8 MEDIUM
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-30180 1 Easysocialfeed 1 Easy Social Feed 2025-06-09 N/A 6.5 MEDIUM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Social Feed allows Stored XSS.This issue affects Easy Social Feed: from n/a through 6.5.3.
CVE-2024-29818 1 Infotheme 1 Wp Poll Maker 2025-06-09 N/A 5.9 MEDIUM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker allows Stored XSS.This issue affects WP Poll Maker: from n/a through 3.1.
CVE-2024-34390 1 Addonmaster 1 Post Grid Master 2025-06-09 N/A 6.5 MEDIUM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue affects Post Grid Master: from n/a through 3.4.8.
CVE-2025-1485 1 Devowl 1 Wordpress Real Cookie Banner 2025-06-09 N/A 4.8 MEDIUM
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-52493 1 Meteor Slides Project 1 Meteor Slides 2025-06-09 N/A 5.9 MEDIUM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Leuze Meteor Slides allows Stored XSS.This issue affects Meteor Slides: from n/a through 1.5.7.
CVE-2024-43125 1 Dotcamp 1 Wp Table Builder 2025-06-09 N/A 6.5 MEDIUM
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder – WordPress Table Plugin allows Stored XSS.This issue affects WP Table Builder – WordPress Table Plugin: from n/a through 1.4.15.
CVE-2025-4429 1 Gearside 1 Gearside Developer Dashboard 2025-06-09 N/A 6.1 MEDIUM
The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2024-35765 1 Wpsoul 1 Greenshift 2025-06-09 N/A 6.5 MEDIUM
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wpsoul Greenshift – animation and page builder blocks allows Stored XSS.This issue affects Greenshift – animation and page builder blocks: from n/a through 8.8.9.1.
CVE-2025-4133 1 Adenion 1 Blog2social 2025-06-09 N/A 5.4 MEDIUM
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks.
CVE-2024-6798 1 Dyadyalesha 1 Dl Verification 2025-06-09 N/A 4.8 MEDIUM
The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-13053 1 10web 1 Form Maker 2025-06-09 N/A 4.8 MEDIUM
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-12874 1 Top Comments Project 1 Top Comments 2025-06-09 N/A 4.8 MEDIUM
The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-12873 1 F1logic 1 Custom Field Manager 2025-06-09 N/A 6.1 MEDIUM
The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2025-22296 1 Hashthemes 1 Hash Elements 2025-06-09 N/A 6.5 MEDIUM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements.This issue affects Hash Elements: from n/a through 1.4.9.
CVE-2025-30873 1 Wpsoul 1 Greenshift 2025-06-09 N/A 6.5 MEDIUM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows Stored XSS. This issue affects Greenshift: from n/a through 11.0.2.