CVE-2022-38460

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in NOTICE BOARD plugin = 1.1 at WordPress...

Cross site scripting

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in NOTICE BOARD plugin = 1.1 at WordPress...

CVE-2022-37339

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

Cross site scripting

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in WHA Crossword plugin = 1.1.10 at WordPress...

CVE-2022-36355

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...

CVE-2022-25604

Authenticated contributor of higher user role Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Price Table plugin versions = 0.2.2...

Shortcodes Ultimate <= 5.0.0 - Authenticated Contributor Code Execution

The Shortcodes Ultimate plugin does not sanitize the "filter" argument to the "sumeta", "suuser", and "supost" shortcodes, allowing the filter to be set to the "system" function which runs arbitrary code. This is being exploited in the wild; I discovered this though analysis of modsecurity audit...