Export limit exceeded: 41894 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (41895 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-5026 | 1 Cminds | 1 Cm Tooltip Glossary | 2025-06-10 | 4.8 Medium |
| The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-13357 | 1 Metaphorcreations | 1 Ditty | 2025-06-10 | 4.8 Medium |
| The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-13383 | 1 Harmonicdesign | 1 Hd Quiz | 2025-06-10 | 4.8 Medium |
| The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-13616 | 1 Vikwp | 1 Vikbooking Hotel Booking Engine \& Pms | 2025-06-10 | 4.8 Medium |
| The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-13619 | 1 Lifterlms | 1 Lifterlms | 2025-06-10 | 6.1 Medium |
| The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2024-13621 | 1 Data443 | 1 Gdpr Framework | 2025-06-10 | 4.8 Medium |
| The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-13727 | 1 Memberspace | 1 Memberspace | 2025-06-10 | 6.1 Medium |
| The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users. | ||||
| CVE-2024-13823 | 1 Yofla | 1 360 Product Rotation | 2025-06-10 | 6.1 Medium |
| The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users. | ||||
| CVE-2024-13828 | 1 Danielpowney | 1 Badgearoo | 2025-06-10 | 6.1 Medium |
| The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2024-12770 | 1 Technowich | 1 Wp Ulike | 2025-06-10 | 4.8 Medium |
| The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-12800 | 1 Brijeshk89 | 1 Ip Based Login | 2025-06-10 | 4.8 Medium |
| The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-12808 | 1 Wedevs | 1 Wp Erp | 2025-06-10 | 4.8 Medium |
| The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-13313 | 1 Aweber | 1 Aweber | 2025-06-10 | 4.8 Medium |
| The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-12743 | 1 Automattic | 1 Mailpoet | 2025-06-10 | 4.8 Medium |
| The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-31583 | 2 Linuxfoundation, Pytorchlightning | 2 Pytorch, Pytorch Lightning | 2025-06-10 | 7.8 High |
| Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp. | ||||
| CVE-2024-31750 | 1 F-logic | 2 Datacube3, Datacube3 Firmware | 2025-06-10 | 9.8 Critical |
| SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter. | ||||
| CVE-2024-12400 | 1 Goodlayers | 1 Tour Master | 2025-06-09 | 7.1 High |
| The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. | ||||
| CVE-2024-12163 | 1 Goodlayers | 1 Goodlayers Core | 2025-06-09 | 6.5 Medium |
| The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads. | ||||
| CVE-2024-6798 | 1 Dyadyalesha | 1 Dl Verification | 2025-06-09 | 4.8 Medium |
| The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-13053 | 1 10web | 1 Form Maker | 2025-06-09 | 4.8 Medium |
| The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||