CVE-2023-0553

The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2023-25459

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Postsnippets Post Snippets plugin = 4.0.2 versions...

CVE-2023-47223

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Map Plugins Basic Interactive World Map plugin = 2.0 versions...

CVE-2023-41242

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Hassan Ali Snap Pixel plugin = 1.5.7 versions...

CVE-2023-23807

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Qumos MojoPlug Slide Panel plugin = 1.1.2 versions...

CVE-2023-23884

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin = 2.5.20 versions...

CVE-2023-6268

The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-6555

The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-33329

Auth. admin+ Reflected Cross-Site Scripting XSS vulnerability in Hijiri Custom Post Type Generator plugin = 2.4.2 versions...

CVE-2023-40677

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Vertical marquee plugin = 7.1 versions...

CVE-2023-26529

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in DupeOff.Com DupeOff plugin = 1.6 versions...

CVE-2023-43270

dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...

CVE-2023-42280

mee-admin 1.5 is vulnerable to Directory Traversal. The download method in the CommonFileController.java file does not verify the incoming data, resulting in arbitrary file reading...

CVE-2023-46818

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled...

CVE-2023-2701

The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin...

CVE-2023-26016

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tauhidul Alam Simple Portfolio Gallery plugin = 0.1 versions...

CVE-2023-0495

The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

CVE-2023-24006

Auth. admin+ Cross-Site Scripting XSS vulnerability in Link Software LLC WP Terms Popup plugin = 2.6.0 versions...

CVE-2022-44625

Auth. admin+ Stored Cross-Site Scripting' vulnerability in Zephilou Cyklodev WP Notify plugin = 1.2.1 versions...

CVE-2022-4491

The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high...