1438 matches found
CVE-2025-32531 WordPress Arconix FAQ plugin <= 1.9.5 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Reflected XSS.This issue affects Arconix FAQ: from n/a through = 1.9.5...
WordPress plugin Arconix FAQ 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2025-17103 · Unknown · Arconix Faq
Name of the Vulnerable Software and Affected Versions: Arconix FAQ versions 1.9.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...
CVE-2025-2964
A vulnerability, which was classified as problematic, was found in ConcreteCMS up to 9.3.9. Affected is the function Save of the component FAQ Block Handler. The manipulation of the argument Navigation/Title Text/Description Source leads to cross site scripting. It is possible to launch the attac...
CVE-2025-2964
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2964
ConcreteCMS (up to 9.3.9) is reported vulnerable due to an XSS in the Save function of the FAQ Block Handler. The issue arises from manipulation of the Navigation/Title Text/Description Source argument, enabling remote attacker access. Public exploit details exist; the vendor was contacted but di...
CVE-2024-13801
The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'bafsetnoticestatus' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated...
CVE-2024-13801 BWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'bafsetnoticestatus' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated...
CVE-2024-13801
CVE-2024-13801 affects BWL Advanced FAQ Manager for WordPress. The vulnerability arises from a missing capability check on the baf_set_notice_status AJAX action, allowing authenticated users with Subscriber level or higher to modify options to value '1'. This can cause a denial of service by trig...
WordPress BWL Advanced FAQ Manager plugin <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update vulnerability
Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Options Update vulnerability discovered by Lucio Sá in WordPress Plugin BWL Advanced FAQ Manager versions = 2.1.4...
CVE-2025-2166
The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated...
CVE-2025-2166 CM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scripting
The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated...
CVE-2025-2166 CM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scripting
The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated...
WordPress plugin CM FAQ 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress CM FAQ plugin <= 1.2.5 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin CM WordPress FAQ Plugin versions = 1.2.5...
CVE-2024-32136
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Xenioushk BWL Advanced FAQ Manager.This issue affects BWL Advanced FAQ Manager: from n/a through 2.0.3...
WordPress CM WordPress FAQ plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM WordPress FAQ Plugin versions = 1.2.0...
WordPress WordPress SEO Friendly Accordion FAQ plugin <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin WordPress SEO Friendly Accordion FAQ versions = 2.2.1...