CVE-2025-50018 WordPress Tealium plugin <= 2.1.20 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tealium Tealium tealium allows Stored XSS.This issue affects Tealium: from n/a through = 2.1.20...

CVE-2025-49858

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through = 2.1.17...

CVE-2025-49858

CVE-2025-49858 concerns the WordPress Arconix Shortcodes plugin. The vulnerability is a Cross-Site Scripting (Stored XSS) due to improper neutralization of input during web page generation, affecting Arconix Shortcodes versions up to and including 2.1.17. The issue is rooted in input handling wit...

CVE-2021-4379

The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmcbulkfixedprice function in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers, with subscriber-level permissions and above, ...

CVE-2024-23508

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17...

PT-2024-19910 · WordPress · Bplugins Pdf Poster

Name of the Vulnerable Software and Affected Versions: bPlugins PDF Poster – PDF Embedder Plugin for WordPress versions 2.1.17 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows Reflected XS...

CVE-2023-49846

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through 2.1.17...

PT-2023-31393 · Unknown · Author Avatars List/Block

Name of the Vulnerable Software and Affected Versions: Paul Bearne Author Avatars List/Block versions 2.1.17 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that a...

CVE-2021-4379

The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmcbulkfixedprice function in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers, with subscriber-level permissions and above, ...

CVE-2021-4376

The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers to change the price of a product to an arbitrary value...

PT-2023-12487 · WordPress · Woocommerce Multi Currency

Name of the Vulnerable Software and Affected Versions: WooCommerce Multi Currency plugin for WordPress versions up to and including 2.1.17 Description: The issue allows authenticated attackers to modify product prices to arbitrary values due to missing authorization. Recommendations: For versions...

Cross site scripting

A vulnerability has been found in Yuna Scatari TBDev up to 2.1.17 and classified as problematic. Affected by this vulnerability is the function getusericons of the file usersearch.php. The manipulation of the argument n/r/r2/em/ip/co/ma/d/d2/ul/ul2/ls/ls2/dl/dl2 leads to cross site scripting. The...

WordPress CURCY plugin <= 2.1.17 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress CURCY plugin versions = 2.1.17. Solution Update the WordPress CURCY plugin to the latest available version at least 2.1.18...

CVE-2021-24664

The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitizetextfield but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues...