CVE-2022-45839

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WHA WHA Puzzle plugin = 1.0.9 versions...

CVE-2022-43458

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Code Tides Advanced Floating Content plugin = 1.2.1 versions...

CVE-2023-24411

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Kerry Kline BNE Testimonials plugin = 2.0.7 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin = 4.0 versions...

CVE-2023-23670

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Team Heateor Fancy Comments WordPress plugin = 1.2.10 versions...

Cross site scripting

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Team Heateor Fancy Comments WordPress plugin = 1.2.10 versions...

CVE-2023-23728

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Winwar Media WP Flipclock plugin = 1.7.4 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin = 3.5.1.9 versions...

CVE-2022-42485

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin = 6.0 versions...

CVE-2023-1155

The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ndccmetaboxccpriceicon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2022-44590

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in James Lao's Simple Video Embedder plugin = 2.2 on WordPress...

CVE-2022-38460

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in NOTICE BOARD plugin = 1.1 at WordPress...

Cross site scripting

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in NOTICE BOARD plugin = 1.1 at WordPress...

CVE-2022-37339

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

Cross site scripting

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in WHA Crossword plugin = 1.1.10 at WordPress...

CVE-2022-36355

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...

CVE-2022-25604

Authenticated contributor of higher user role Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Price Table plugin versions = 0.2.2...

Shortcodes Ultimate <= 5.0.0 - Authenticated Contributor Code Execution

The Shortcodes Ultimate plugin does not sanitize the "filter" argument to the "sumeta", "suuser", and "supost" shortcodes, allowing the filter to be set to the "system" function which runs arbitrary code. This is being exploited in the wild; I discovered this though analysis of modsecurity audit...