Total
36870 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-0839 | 1 Digitalzoomstudio | 1 Zoomsounds | 2025-06-04 | N/A | 6.4 MEDIUM |
| The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-22725 | 1 Orthanc-server | 1 Orthanc | 2025-06-04 | N/A | 6.1 MEDIUM |
| Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting. | |||||
| CVE-2024-22048 | 1 Gov.uk | 1 Govuk Tech Docs | 2025-06-04 | N/A | 6.1 MEDIUM |
| govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page. | |||||
| CVE-2024-27186 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | 6.1 MEDIUM |
| The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | |||||
| CVE-2024-40743 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | 6.1 MEDIUM |
| The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. | |||||
| CVE-2024-40745 | 1 Convert Forms Project | 1 Convert Forms | 2025-06-04 | N/A | 5.4 MEDIUM |
| Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8. | |||||
| CVE-2024-40747 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | 6.1 MEDIUM |
| Various module chromes didn't properly process inputs, leading to XSS vectors. | |||||
| CVE-2024-40748 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | 7.5 HIGH |
| Lack of output escaping in the id attribute of menu lists. | |||||
| CVE-2024-10144 | 1 Robosoft | 1 Robo Gallery | 2025-06-04 | N/A | 4.8 MEDIUM |
| The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10054 | 1 Happyforms | 1 Happyforms | 2025-06-04 | N/A | 4.8 MEDIUM |
| The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10107 | 1 Seedprod | 1 Rafflepress | 2025-06-04 | N/A | 4.8 MEDIUM |
| The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10145 | 1 Devpups | 1 Social Pug | 2025-06-04 | N/A | 4.8 MEDIUM |
| The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10504 | 1 Reputeinfosystems | 1 Arforms | 2025-06-04 | N/A | 5.4 MEDIUM |
| The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks. | |||||
| CVE-2024-11109 | 1 Ljapps | 1 Wp Google Review Slider | 2025-06-04 | N/A | 4.8 MEDIUM |
| The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-3996 | 1 Shapedplugin | 1 Smart Post Show | 2025-06-04 | N/A | 6.1 MEDIUM |
| The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2025-4852 | 1 Totolink | 2 A3002r, A3002r Firmware | 2025-06-04 | 3.3 LOW | 2.4 LOW |
| A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the component VPN Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-6668 | 1 Wpproking | 1 Profilepro | 2025-06-04 | N/A | 5.4 MEDIUM |
| The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks | |||||
| CVE-2025-3888 | 1 Artbees | 1 Jupiter X Core | 2025-06-04 | N/A | 6.4 MEDIUM |
| The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the included SVG file. | |||||
| CVE-2025-4669 | 1 Wpbookingcalendar | 1 Wp Booking Calendar | 2025-06-04 | N/A | 6.4 MEDIUM |
| The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-6708 | 1 Cozmoslabs | 1 Profile Builder | 2025-06-04 | N/A | 4.8 MEDIUM |
| The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks. | |||||