CVE-2025-3662

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher Marc Montpas escalated it to an Unauthenticated Stored XSS...

Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

Summary An unauthenticated information disclosure vulnerability exists in the PSU deployment of HAX CMS via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues e.g., HAX-3...

Drupal COOKiES Consent Management module < 1.2.15 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module COOKiES Consent Management versions 1.2.15...

CVE-2024-33517

An unauthenticated Denial-of-Service DoS vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service...

CVE-2024-33515

Unauthenticated Denial-of-Service DoS vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected service...

CVE-2024-10314

In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service DoS via the auto-generation function was identified. Reported by Karol Więsek...

CVE-2023-30754

Unauth. Reflected Cross-Site Scripting XSS vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt plugin = 1.8.5 versions...

CVE-2023-47544

Unauth. Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin = 3.12 versions...

CVE-2023-47517

Unauth. Reflected Cross-Site Scripting XSS vulnerability in SendPress Newsletters plugin = 1.23.11.6 versions...

CVE-2023-47665

Unauth. Reflected Cross-Site Scripting XSS vulnerability in edwardplainview Plainview Protect Passwords plugin = 1.4 versions...

CVE-2023-47518

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Matthew Muro Restrict Categories plugin = 2.6.4 versions...

CVE-2023-29441

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Robert Heller WebLibrarian plugin = 3.5.8.1 versions...

CVE-2023-29172

Unauth. Reflected Cross-Site Scripting XSS vulnerability in PropertyHive plugin = 1.5.46 versions...

CVE-2023-41872

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Xtemos WoodMart plugin = 7.2.4 versions...

CVE-2023-41692

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Hennessey Digital Attorney theme = 3 theme...

CVE-2023-41662

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ulf Benjaminsson WP-dTree plugin = 4.4.5 versions...

CVE-2023-41871

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Poll Maker Team Poll Maker plugin = 4.7.0 versions...

CVE-2023-32298

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kathy Darling Simple User Listing plugin = 1.9.2 versions...

CVE-2023-32740

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kunal Nagar Custom 404 Pro plugin = 3.8.1 versions...

CVE-2023-32108

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ignazio Scimone Albo Pretorio On line plugin = 4.6.3 versions...