Export limit exceeded: 366060 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 366060 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366060 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-0373 | 1 Smartwp | 1 Lightweight Accordion | 2025-03-21 | 5.4 Medium |
| The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2023-0333 | 1 Templatesnext | 1 Templatesnext Toolkit | 2025-03-21 | 5.4 Medium |
| The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2023-0220 | 1 Pinpoint | 1 Pinpoint Booking System | 2025-03-21 | 8.8 High |
| The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks. | ||||
| CVE-2022-4678 | 1 Templatesnext | 1 Templatesnext Toolkit | 2025-03-21 | 5.4 Medium |
| The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2022-4551 | 1 Croover | 1 Rich Table Of Contents | 2025-03-21 | 5.4 Medium |
| The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2023-1809 | 1 W3eden | 1 Download Manager | 2025-03-21 | 7.5 High |
| The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files. | ||||
| CVE-2023-25240 | 1 Pimcore | 1 Pimcore | 2025-03-21 | 8.8 High |
| An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. | ||||
| CVE-2023-20932 | 1 Google | 1 Android | 2025-03-21 | 3.3 Low |
| In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-248251018 | ||||
| CVE-2023-0275 | 1 Tipsandtricks-hq | 1 Easy Accept Payments For Paypal | 2025-03-21 | 5.4 Medium |
| The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-0261 | 1 Ljapps | 1 Wp Tripadvisor Review Slider | 2025-03-21 | 8.8 High |
| The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. | ||||
| CVE-2023-0259 | 1 Ljapps | 1 Wp Google Review Slider | 2025-03-21 | 8.8 High |
| The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. | ||||
| CVE-2023-0255 | 1 Shortpixel | 1 Enable Media Replace | 2025-03-21 | 8.8 High |
| The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. | ||||
| CVE-2023-0166 | 1 Pickplugins | 1 Product Slider For Woocommerce | 2025-03-21 | 5.4 Medium |
| The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-0151 | 1 Utubevideo Gallery Project | 1 Utubevideo Gallery | 2025-03-21 | 5.4 Medium |
| The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-0080 | 1 Cusrev | 1 Customer Reviews For Woocommerce | 2025-03-21 | 8.8 High |
| The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability. | ||||
| CVE-2022-4682 | 1 Wpgogo | 1 Lightbox-gallery | 2025-03-21 | 6.8 Medium |
| The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2022-4458 | 1 Amr Shortcode Any Widget Project | 1 Amr Shortcode Any Widget | 2025-03-21 | 5.4 Medium |
| The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | ||||
| CVE-2022-20551 | 1 Google | 1 Android | 2025-03-21 | 6.7 Medium |
| In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-243376549 | ||||
| CVE-2022-20481 | 1 Google | 1 Android | 2025-03-21 | 5.5 Medium |
| In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241927115 | ||||
| CVE-2022-20455 | 1 Google | 1 Android | 2025-03-21 | 5.5 Medium |
| In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242537431 | ||||