500 matches found
CVE-2024-5809
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users...
CVE-2024-6073
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-6266
A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2. Affected is an unknown function of the file /system/dictData/loadDictItem. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and...
CVE-2024-13055
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-53795
Missing Authorization vulnerability in andymoyle Church Admin church-admin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Church Admin: from n/a through = 5.0.8...
CVE-2024-12663
A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the component Login. The manipulation of the argument username leads to observable response discrepancy. The attack can be initiated remotely. The...
CVE-2023-0553
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2023-25459
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Postsnippets Post Snippets plugin = 4.0.2 versions...
CVE-2023-47223
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Map Plugins Basic Interactive World Map plugin = 2.0 versions...
CVE-2023-41242
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Hassan Ali Snap Pixel plugin = 1.5.7 versions...
CVE-2023-23807
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Qumos MojoPlug Slide Panel plugin = 1.1.2 versions...
CVE-2023-23884
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin = 2.5.20 versions...
CVE-2023-6268
The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-6555
The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-33329
Auth. admin+ Reflected Cross-Site Scripting XSS vulnerability in Hijiri Custom Post Type Generator plugin = 2.4.2 versions...
CVE-2023-40677
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Vertical marquee plugin = 7.1 versions...
CVE-2023-26529
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in DupeOff.Com DupeOff plugin = 1.6 versions...
CVE-2023-43270
dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...