CVE-2018-6357

The acxasmwsaveordercallback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant socialwidgeticonarrayorder XSS...

CVE-2013-1949

Social Media Widget social-media-widget plugin 4.0 for WordPress contains an externally introduced modification Trojan Horse, which allows remote attackers to force the upload of arbitrary files...

CVE-2013-2704

Cross-site request forgery CSRF vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS sequences...

CVE-2013-2311

Cross-site scripting XSS vulnerability in static/js/share.js aka the social bookmarking widget in Web2py before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-11739

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the...

CVE-2017-20158

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The...

CVE-2019-15954

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...

CVE-2014-125051

A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this...

CVE-2019-17271

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter...

CVE-2019-17072

The new-contact-form-widget aka Contact Form Widget - Contact Query, Form Maker plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php...

CVE-2018-16519

COYO 9.0.8, 10.0.11 and 12.0.4 has cross-site scripting XSS via URLs used by "iFrame" widgets...

CVE-2012-1407

Unspecified vulnerability in the GO Message Widget com.gau.go.launcherex.gowidget.smswidget application 1.9, 2.1, and 2.3 for Android has unknown impact and attack vectors...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2012-1406

Unspecified vulnerability in the GO Bookmark Widget com.gau.go.launcherex.gowidget.bookmark application 1.1 for Android has unknown impact and attack vectors...

CVE-2012-1405

Unspecified vulnerability in the GO Note Widget com.gau.go.launcherex.gowidget.notewidget application 1.5 and 1.9 for Android has unknown impact and attack vectors...

CVE-2012-1394

Unspecified vulnerability in the GO Email Widget com.gau.go.launcherex.gowidget.emailwidget application 1.3.1, 1.8, and 1.81 for Android has unknown impact and attack vectors...

CVE-2010-1008

Cross-site scripting XSS vulnerability in the Sellector.com Widget Integration chsellector extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2025-46441

Path Traversal: '.../...//' vulnerability in ctltwp Section Widget section-widget allows Path Traversal.This issue affects Section Widget: from n/a through = 3.3.1...

CVE-2025-48252

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Back Button Widget back-button-widget allows Stored XSS.This issue affects Back Button Widget: from n/a through = 1.6.8...

CVE-2025-46441

Path Traversal: '.../...//' vulnerability in ctltwp Section Widget section-widget allows Path Traversal.This issue affects Section Widget: from n/a through = 3.3.1...