CVE-2022-2575

The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2021-25038

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmussourceblog and wmusrecordperpage parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

CVE-2020-28033

WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed...

WordPress Multisite Post Duplicator 0.9.5.1 Plugin - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications alert1" input type="text" name=...

WordPress Multisite Post Duplicator 0.9.5.1 Cross Site Request Forgery

Details ================ Software: Multisite Post Duplicator Version: 0.9.5.1 Homepage: http://wordpress.org/plugins/multisite-post-duplicator/ Advisory report:...

CVE-2014-5240

Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...