CVE-2025-1453 Category Posts Widget < 4.9.20 - Admin+ Stored XSS

The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1976 Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6...

CVE-2025-1976 Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6...

CVE-2025-2162

The MapPress Maps for WordPress plugin (versions prior to 2.94.10 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape specific plugin settings. This flaw allows high-privilege users, such as administrators, to execute XSS attacks ev...

CVE-2025-2162: Improper Neutralization of Input During Web Page Generation

The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1525

The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1524

The Ultimate Dashboard WordPress plugin (versions prior to 3.8.6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the insufficient sanitization and escaping of certain plugin settings. This flaw allows high-privilege users, such as administrators, to execute XSS at...

CVE-2025-1525 Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS

The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13610

The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-13207

The Widget for Social Page Feeds WordPress plugin versions prior to 6.4.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization and escaping of certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to ...

CVE-2025-2871

CVE-2025-2871 pertains to WordPress Mega Menu – QuadMenu. A CSRF flaw in ajax_dismiss_notice() with missing nonce validation affects all versions up to 3.2.0, enabling unauthenticated attackers to update any user meta (including wp_capabilities) via a forged request if a site admin is tricked int...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization that allows an admin user to escalate privileges. Remediation Upgrade magento/community-edition to version 2.4.4-p13, 2.4.5-p12, 2.4.6-p10, 2.4.7-p5...

WordPress BookingPress plugin <= 1.1.28 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Phat RiO in WordPress Plugin BookingPress versions = 1.1.28...

CVE-2024-13863

The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13122

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12682

The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10560

The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10679

The Quiz and Survey Master (QSM) WordPress plugin, in versions prior to 9.2.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability allows high-privilege users, such as administrators, to pe...

CVE-2024-11272 Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS

The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed fo...

CVE-2024-10703 Registrations for The Events Calendar < 2.13.4 - Admin+ Stored XSS

The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...