Total
36870 CVE
CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
---|---|---|---|---|---|
CVE-2024-12400 | 1 Goodlayers | 1 Tour Master | 2025-06-09 | N/A | 7.1 HIGH |
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. | |||||
CVE-2024-12163 | 1 Goodlayers | 1 Goodlayers Core | 2025-06-09 | N/A | 6.5 MEDIUM |
The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads. | |||||
CVE-2024-10510 | 1 Netfunkdesign | 1 Adbuddy\+ \(adblocker Detection\) | 2025-06-09 | N/A | 4.8 MEDIUM |
The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
CVE-2023-6163 | 1 Themeum | 1 Wp Crowdfunding | 2025-06-09 | N/A | 4.8 MEDIUM |
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
CVE-2023-5956 | 1 Markusbegerow | 1 Wp-adv-quiz | 2025-06-09 | N/A | 4.8 MEDIUM |
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
CVE-2024-30180 | 1 Easysocialfeed | 1 Easy Social Feed | 2025-06-09 | N/A | 6.5 MEDIUM |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Social Feed allows Stored XSS.This issue affects Easy Social Feed: from n/a through 6.5.3. | |||||
CVE-2024-29818 | 1 Infotheme | 1 Wp Poll Maker | 2025-06-09 | N/A | 5.9 MEDIUM |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker allows Stored XSS.This issue affects WP Poll Maker: from n/a through 3.1. | |||||
CVE-2024-34390 | 1 Addonmaster | 1 Post Grid Master | 2025-06-09 | N/A | 6.5 MEDIUM |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue affects Post Grid Master: from n/a through 3.4.8. | |||||
CVE-2025-1485 | 1 Devowl | 1 Wordpress Real Cookie Banner | 2025-06-09 | N/A | 4.8 MEDIUM |
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
CVE-2024-52493 | 1 Meteor Slides Project | 1 Meteor Slides | 2025-06-09 | N/A | 5.9 MEDIUM |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Leuze Meteor Slides allows Stored XSS.This issue affects Meteor Slides: from n/a through 1.5.7. | |||||
CVE-2024-43125 | 1 Dotcamp | 1 Wp Table Builder | 2025-06-09 | N/A | 6.5 MEDIUM |
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder – WordPress Table Plugin allows Stored XSS.This issue affects WP Table Builder – WordPress Table Plugin: from n/a through 1.4.15. | |||||
CVE-2025-4429 | 1 Gearside | 1 Gearside Developer Dashboard | 2025-06-09 | N/A | 6.1 MEDIUM |
The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | |||||
CVE-2024-35765 | 1 Wpsoul | 1 Greenshift | 2025-06-09 | N/A | 6.5 MEDIUM |
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wpsoul Greenshift – animation and page builder blocks allows Stored XSS.This issue affects Greenshift – animation and page builder blocks: from n/a through 8.8.9.1. | |||||
CVE-2025-4133 | 1 Adenion | 1 Blog2social | 2025-06-09 | N/A | 5.4 MEDIUM |
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks. | |||||
CVE-2024-6798 | 1 Dyadyalesha | 1 Dl Verification | 2025-06-09 | N/A | 4.8 MEDIUM |
The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
CVE-2024-13053 | 1 10web | 1 Form Maker | 2025-06-09 | N/A | 4.8 MEDIUM |
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
CVE-2024-12874 | 1 Top Comments Project | 1 Top Comments | 2025-06-09 | N/A | 4.8 MEDIUM |
The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
CVE-2024-12873 | 1 F1logic | 1 Custom Field Manager | 2025-06-09 | N/A | 6.1 MEDIUM |
The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | |||||
CVE-2025-22296 | 1 Hashthemes | 1 Hash Elements | 2025-06-09 | N/A | 6.5 MEDIUM |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements.This issue affects Hash Elements: from n/a through 1.4.9. | |||||
CVE-2025-30873 | 1 Wpsoul | 1 Greenshift | 2025-06-09 | N/A | 6.5 MEDIUM |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows Stored XSS. This issue affects Greenshift: from n/a through 11.0.2. |