PT-2022-15170

Name of the Vulnerable Software and Affected Versions The Simple Post Notes WordPress plugin versions prior to 1.7.6 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings. This can...

CVE-2022-2194: Improper Neutralization of Input During Web Page Generation

The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-2148: Improper Neutralization of Input During Web Page Generation

The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-15041

Name of the Vulnerable Software and Affected Versions The Loading Page with Loading Screen WordPress plugin versions prior to 1.0.83 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the plugin not escaping its settings. This can occ...

PT-2022-15193

Name of the Vulnerable Software and Affected Versions Accept Stripe Payments WordPress plugin versions prior to 2.0.64 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the plugin's failure to sanitize and escape some of its settings...

CVE-2022-2100: Improper Neutralization of Input During Web Page Generation

The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-14858

Name of the Vulnerable Software and Affected Versions The Page Generator WordPress plugin versions prior to 1.6.5 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings, even when the...

PT-2022-14964

Name of the Vulnerable Software and Affected Versions The LinkedIn Company Updates WordPress plugin versions 1.5.3 and earlier Description The issue allows high privilege users, such as admin, to perform cross-Site Scripting attacks due to the plugin not sanitising and escaping its settings. This...

PT-2022-14968

Name of the Vulnerable Software and Affected Versions The Very Simple Breadcrumb WordPress plugin through 1.0 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings. This is possible...

CVE-2022-2118: Improper Neutralization of Input During Web Page Generation

The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-14872

Name of the Vulnerable Software and Affected Versions The Data Tables Generator by Supsystic WordPress plugin versions prior to 1.10.20 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is...

GiveWP < 2.21.0 - Manager+ Arbitrary File Creation via Export

The plugin does not validate the exported file, which could allow high privilege users such as Managers to create arbitrary files...

CVE-2022-2093

The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1894: Improper Neutralization of Input During Web Page Generation

The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltredhtml is disallowed...

CVE-2022-2050: Improper Neutralization of Input During Web Page Generation

The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when unfilteredhtml is disallowed...

PT-2022-14712

Name of the Vulnerable Software and Affected Versions WP-Paginate WordPress plugin versions prior to 2.1.9 Description The issue allows high privilege users to perform Stored Cross-Site Scripting attacks when unfiltered html is disallowed, due to the plugin not escaping one of its settings...

PT-2022-14849

Name of the Vulnerable Software and Affected Versions Bold Page Builder WordPress plugin versions prior to 4.3.3 Description The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to perform Cross-Site...

WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup PoC On...

CVE-2021-25056

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...