116 matches found
WordPress NinjaTeam Header Footer Custom Code plugin <= 1.2 - Admin+ Stored XSS via CSS Styles vulnerability
Admin+ Stored XSS via CSS Styles vulnerability discovered by Bob Matyas in WordPress Plugin NinjaTeam Header Footer Custom Code versions = 1.2...
WordPress SureForms plugin < 1.4.4 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin SureForms versions 1.4.4...
WordPress Ultimate Dashboard plugin < 3.8.6 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Ultimate Dashboard versions 3.8.6...
CVE-2024-5200 Postie < 1.9.71 - Admin+ Stored XSS
The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-5200
The Postie WordPress plugin (versions before 1.9.71 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the lack of proper sanitization and escaping of certain plugin settings. This flaw allows high-privileged users, such as administrators, to perform XSS attacks, eve...
CVE-2025-56807
A Stored Cross-Site Scripting (XSS) vulnerability exists in FairSketch RISE Ultimate Project Manager & CRM version 3.9.4 within the File Manager functionality. The flaw is caused by insufficient input sanitization of the title parameter when creating new folders in the admin dashboard. An attacke...
CVE-2025-3584 Newsletter < 8.8.2 - Admin+ Stored XSS via Subscription
The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-30745
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Phan Chuong IP Metaboxes plugin = 2.1.1 versions...
CVE-2023-23723
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Winwar Media WP Email Capture plugin = 3.9.3 versions...
WordPress Contact Form & SMTP Plugin for WordPress by PirateForms plugin < 2.6.0 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Contact Form & SMTP Plugin versions 2.6.0...
CVE-2025-0717 Social Slider Feed < 2.2.9 - Admin+ Stored XSS
To exploit the vulnerability, it is necessary:...
WordPress NextGEN Gallery plugin < 3.59.9 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin NextGEN Gallery versions 3.59.9...
CVE-2024-11645 Float Block <= 1.7 - Admin+ Stored XSS via Widget
The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress Download Manager plugin < 3.3.03 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Download Manager versions 3.3.03...
CVE-2024-10704 Photo Gallery by 10Web < 1.8.31 - Admin+ Stored XSS
The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress YaDisk Files plugin <= 1.2.5 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by WPscan in WordPress Plugin YaDisk Files versions = 1.2.5...
CVE-2024-7877 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is...
CVE-2024-8983 Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS
Custom Twitter Feeds WordPress plugin before 2.2.3 is not filtering some of its settings allowing high privilege users to inject scripts...
CVE-2024-7822
The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...