Export limit exceeded: 367714 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (367714 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-4760 | 1 Onlinestorekit | 1 Oneclick Chat To Order | 2025-04-02 | 5.4 Medium |
| The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4758 | 1 10web | 1 Map Builder For Google Maps | 2025-04-02 | 5.4 Medium |
| The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4746 | 1 Wpmanageninja | 1 Fluentauth | 2025-04-02 | 7.5 High |
| The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin. | ||||
| CVE-2022-4716 | 1 Timersys | 1 Wp Popups | 2025-04-02 | 5.4 Medium |
| The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4693 | 1 Pickplugins | 1 User Verification | 2025-04-02 | 9.8 Critical |
| The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website. | ||||
| CVE-2022-4675 | 1 Mongoosemarketplace | 1 Mongoose Page Plugin | 2025-04-02 | 5.4 Medium |
| The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | ||||
| CVE-2022-4673 | 1 Blazzdev | 1 Rate My Post | 2025-04-02 | 5.4 Medium |
| The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | ||||
| CVE-2022-4672 | 1 Tipsandtricks-hq | 1 Wordpress Simple Paypal Shopping Cart | 2025-04-02 | 5.4 Medium |
| The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4668 | 1 Easy-appointments | 1 Easy Appointments | 2025-04-02 | 5.4 Medium |
| The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4629 | 1 Shapedplugin | 1 Product Slider For Woocommerce | 2025-04-02 | 5.4 Medium |
| The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4625 | 1 Wpbrigade | 1 Login Logout Menu | 2025-04-02 | 5.4 Medium |
| The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4624 | 1 Gsplugins | 1 Gs Logo Slider | 2025-04-02 | 5.4 Medium |
| The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4576 | 1 Easy Bootstrap Shortcode Project | 1 Easy Bootstrap Shortcode | 2025-04-02 | 5.4 Medium |
| The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4570 | 1 Top 10 Project | 1 Top 10 | 2025-04-02 | 5.4 Medium |
| The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-4509 | 1 Code-atlantic | 1 Content Control | 2025-04-02 | 5.4 Medium |
| The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins. | ||||
| CVE-2022-4475 | 1 Twinpictures | 1 Collapse-o-matic | 2025-04-02 | 5.4 Medium |
| The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. | ||||
| CVE-2022-4474 | 1 Easysocialfeed | 1 Easy Social Feed | 2025-04-02 | 5.4 Medium |
| The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. | ||||
| CVE-2022-4443 | 1 Brutebank | 1 Brutebank | 2025-04-02 | 6.5 Medium |
| The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. | ||||
| CVE-2022-4383 | 1 Codeboxr | 1 Cbx Petition For Wordpress | 2025-04-02 | 9.8 Critical |
| The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | ||||
| CVE-2022-4346 | 1 Updraftplus | 1 All-in-one Security | 2025-04-02 | 5.3 Medium |
| The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address. | ||||