9938 matches found
The vulnerability of the reviewdog/action-setup component of the GitHub collaborative development platform allows a hacker to disclose protected information.
The vulnerability of the reviewdog/action-setup component of the GitHub collaborative development platform is related to the presence of undeclared capabilities. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...
CVE-2024-13122
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-11272
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed fo...
CVE-2024-10703
The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...
CVE-2025-1452
The Favorites WordPress plugin versions prior to 2.3.5 contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as administrators, to perform XSS attacks. This remains a risk...
CVE-2024-13123 AFI < 1.100.0 - Admin+ Stored XSS
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-13122 AFI < 1.100.0 - Admin+ Stored XSS
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-13122
The AFI WordPress plugin (versions prior to 1.100.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to properly sanitise and escape certain settings, allowing high-privilege users, such as administrators, to execute XSS attacks. This vulnerability pe...
CVE-2024-13123
The AFI WordPress plugin versions prior to 1.100.0 are vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings, which allows high-privilege users, such as administrators, to execute malicious scripts. This vul...
CVE-2024-10679 Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS
The Quiz and Survey Master QSM WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-10560
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-10472
The Stylish Price List WordPress plugin versions prior to 7.1.12 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as those with contributor roles, to execute XSS ...
CVE-2024-10105
The Job Postings WordPress plugin versions prior to 2.7.11 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings within the plugin. This flaw allows high-privilege users, such as those with contributor status, t...
CVE-2024-10679: Improper Neutralization of Input During Web Page Generation
The Quiz and Survey Master QSM WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-13123: Improper Neutralization of Input During Web Page Generation
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Exploit for Deserialization of Untrusted Data in Apache Tomcat
Tomcat CVE-2025-24813 playground ===============================...
Exploit for CVE-2025-29927
Introduction By manipulating the x-middleware-subrequest req...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-30154link is external reviewdog action-setup GitHub Action Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent attack vectors for...
CVE-2025-1203
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example ...
