Export limit exceeded: 365286 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (365286 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-4693 | 1 Pickplugins | 1 User Verification | 2025-04-02 | 9.8 Critical |
| The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website. | ||||
| CVE-2022-4675 | 1 Mongoosemarketplace | 1 Mongoose Page Plugin | 2025-04-02 | 5.4 Medium |
| The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | ||||
| CVE-2022-4673 | 1 Blazzdev | 1 Rate My Post | 2025-04-02 | 5.4 Medium |
| The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | ||||
| CVE-2022-4672 | 1 Tipsandtricks-hq | 1 Wordpress Simple Paypal Shopping Cart | 2025-04-02 | 5.4 Medium |
| The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4668 | 1 Easy-appointments | 1 Easy Appointments | 2025-04-02 | 5.4 Medium |
| The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4629 | 1 Shapedplugin | 1 Product Slider For Woocommerce | 2025-04-02 | 5.4 Medium |
| The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4625 | 1 Wpbrigade | 1 Login Logout Menu | 2025-04-02 | 5.4 Medium |
| The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4624 | 1 Gsplugins | 1 Gs Logo Slider | 2025-04-02 | 5.4 Medium |
| The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4576 | 1 Easy Bootstrap Shortcode Project | 1 Easy Bootstrap Shortcode | 2025-04-02 | 5.4 Medium |
| The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4570 | 1 Top 10 Project | 1 Top 10 | 2025-04-02 | 5.4 Medium |
| The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4509 | 1 Code-atlantic | 1 Content Control | 2025-04-02 | 5.4 Medium |
| The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins. | ||||
| CVE-2022-4475 | 1 Twinpictures | 1 Collapse-o-matic | 2025-04-02 | 5.4 Medium |
| The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. | ||||
| CVE-2022-4474 | 1 Easysocialfeed | 1 Easy Social Feed | 2025-04-02 | 5.4 Medium |
| The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. | ||||
| CVE-2022-4443 | 1 Brutebank | 1 Brutebank | 2025-04-02 | 6.5 Medium |
| The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. | ||||
| CVE-2022-4383 | 1 Codeboxr | 1 Cbx Petition For Wordpress | 2025-04-02 | 9.8 Critical |
| The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | ||||
| CVE-2022-4346 | 1 Updraftplus | 1 All-in-one Security | 2025-04-02 | 5.3 Medium |
| The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address. | ||||
| CVE-2022-4307 | 1 Wp-master | 1 Pardakht-delkhah | 2025-04-02 | 6.1 Medium |
| The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from the plugin. | ||||
| CVE-2022-4230 | 1 Veronalabs | 1 Wp Statistics | 2025-04-02 | 8.8 High |
| The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well. | ||||
| CVE-2022-4054 | 1 Gitlab | 1 Gitlab | 2025-04-02 | 5.5 Medium |
| An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers. | ||||
| CVE-2022-4017 | 1 Booster | 3 Booster Elite Woocommerce, Booster For Woocommerce, Booster Plus Woocommerce | 2025-04-02 | 8.8 High |
| The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks | ||||