Lucene search
+L

9511 matches found

NVD
NVD
added 2025/09/30 11:37 a.m.6 views

CVE-2025-10189

The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdmlogin' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

6.4CVSS0.00193EPSS
SaveExploits0References2
NVD
NVD
added 2025/09/30 11:37 a.m.12 views

CVE-2025-10128

The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

6.4CVSS0.00193EPSS
SaveExploits0References2
NVD
NVD
added 2025/09/30 11:37 a.m.8 views

CVE-2025-10131

The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

6.4CVSS0.00193EPSS
SaveExploits0References2
NVD
NVD
added 2025/09/30 11:37 a.m.10 views

CVE-2025-10182

The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

6.4CVSS0.00235EPSS
SaveExploits0References2
NVD
NVD
added 2025/09/30 11:37 a.m.6 views

CVE-2025-10179

The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

6.4CVSS0.002EPSS
SaveExploits0References2
NVD
NVD
added 2025/09/30 11:37 a.m.13 views

CVE-2025-10130

The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

6.4CVSS0.00239EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2025/09/30 4:27 a.m.5 views

CVE-2025-6941 LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepointresources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escapin...

6.4CVSS4.8AI score0.00248EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2025/09/30 4:27 a.m.15 views

CVE-2025-6941 LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepointresources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escapin...

6.4CVSS0.00248EPSS
SaveExploits0References4
CVE
CVE
added 2025/09/30 4:27 a.m.33 views

CVE-2025-6941

CVE-2025-6941 is a stored XSS in the WordPress plugin LatePoint (Calendar Booking Plugin for Appointments and Events). The issue arises from insufficient input sanitization/escaping in the id parameter of the latepoint_resources shortcode, affecting all versions up to and including 5.1.94. Exploi...

6.4CVSS4.8AI score0.00248EPSS
SaveExploits0References4
CVE
CVE
added 2025/09/30 3:35 a.m.30 views

CVE-2025-10196

CVE-2025-10196 affects the Survey Anyplace WordPress plugin (versions

6.4CVSS4.7AI score0.00231EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2025/09/30 3:35 a.m.20 views

CVE-2025-10128 Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

6.4CVSS0.00193EPSS
SaveExploits0References2
CVE
CVE
added 2025/09/30 3:35 a.m.37 views

CVE-2025-10128

CVE-2025-10128 — Eulerpool Research Systems WordPress Plugin is affected by a stored cross-site scripting vulnerability in the plugin’s aaq shortcode. Reported across multiple sources, it affects all versions up to and including 4.0.1. The root cause is insufficient input sanitization and output ...

6.4CVSS4.7AI score0.00193EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2025/09/30 3:35 a.m.7 views

CVE-2025-10128 Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

6.4CVSS4.7AI score0.00193EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2025/09/30 3:35 a.m.12 views

CVE-2025-10168 Any News Ticker <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

6.4CVSS0.00302EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2025/09/30 3:35 a.m.11 views

CVE-2025-10189 BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdmlogin' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

6.4CVSS0.00193EPSS
SaveExploits0References2
CVE
CVE
added 2025/09/30 3:35 a.m.37 views

CVE-2025-10189

CVE-2025-10189 : WordPress BP Direct Menus plugin (versions

6.4CVSS4.7AI score0.00193EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2025/09/30 3:35 a.m.3 views

CVE-2025-10168 Any News Ticker <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

6.4CVSS4.7AI score0.00302EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2025/09/30 3:35 a.m.14 views

CVE-2025-10182 dbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

6.4CVSS0.00235EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2025/09/30 3:35 a.m.8 views

CVE-2025-10182 dbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

6.4CVSS4.7AI score0.00235EPSS
SaveExploits0References2
CVE
CVE
added 2025/09/30 3:35 a.m.44 views

CVE-2025-10182

CVE-2025-10182: WordPress dbview plugin variants up to 0.5.5 exposed a Stored Cross-Site Scripting vulnerability in the dbview shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject scripts that run when use...

6.4CVSS4.7AI score0.00235EPSS
SaveExploits0References2
Rows per page
Query Builder