EUVD-2026-40896

The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and including, 18.1. This is due to insufficient input sanitization and output escaping in admin/partials/googlecrawldfs.php, where the $GET'place'...

CVE-2026-13015: Improper Neutralization of Input During Web Page Generation

The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and including, 18.1. This is due to insufficient input sanitization and output escaping in admin/partials/googlecrawldfs.php, where the $GET'place'...

PT-2023-12540

Name of the Vulnerable Software and Affected Versions Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress versions up to, and including, 3.4.31 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation in the...

CVE-2021-4244

A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/addfieldtoform.php. The manipulation of the argument fieldname/mergetag/fieldtype/listid leads to cross site scripting. It...

CVE-2021-4244: Improper Neutralization

A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/addfieldtoform.php. The manipulation of the argument fieldname/mergetag/fieldtype/listid leads to cross site scripting. It...

PT-2021-20603

Name of the Vulnerable Software and Affected Versions: Poll Maker WordPress plugin versions up to and including 3.2.8 Description: The issue allows attackers to inject arbitrary web scripts via the mcount parameter found in the /admin/partials/settings/poll-maker-settings.php file, enabling...

CVE-2019-1010124

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

CVE-2019-1010124: Improper Neutralization of Input During Web Page Generation

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

WordPress WebAppick WooCommerce Product Feed Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WebAppick WooCommerce Product Feed is a plugin used in WordPress to generate product feed data. A cross-site scripting...

CVE-2019-1010124

Summary: CVE-2019-1010124 affects WebAppick WooCommerce Product Feed (versions

PT-2018-6606

Name of the Vulnerable Software and Affected Versions: E-goi Smart Marketing SMS and Newsletters Forms plugin versions prior to 2.0.0 Description: The issue concerns a cross-site scripting XSS flaw. It can be exploited via the "url" parameter in the admin/partials/custom/egoi-for-wp-form egoi.php...

CVE-2017-18010: Improper Neutralization of Input During Web Page Generation

The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-formegoi.php url parameter...

CVE-2017-16758

Cross-site scripting XSS vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "accesstoken" parameter...

PT-2017-14540

Name of the Vulnerable Software and Affected Versions Ultimate Instagram Feed plugin versions prior to 1.3 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the access token parameter in the...

CVE-2017-16758: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "accesstoken" parameter...

PT-2017-14248

Name of the Vulnerable Software and Affected Versions user-login-history plugin for WordPress versions through 1.5.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters to the "admin/partials/listing/listing.php" endpoint, including date fro...