7247 matches found
CVE-2023-25958
CVE-2023-25958 is an admin+ authenticated, stored cross-site scripting (XSS) vulnerability in the WordPress plugin Simple Tooltips
Cross site scripting
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Gautam Thapar Button Builder – Buttons X plugin = 0.8.6 versions...
CVE-2023-23867
CVE-2023-23867: WordPress Button Builder – Buttons X plugin
CVE-2023-32082
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...
Code injection
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...
CVE-2023-32082 etcd key name can be accessed via LeaseTimeToLive API
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...
CVE-2023-32082 etcd key name can be accessed via LeaseTimeToLive API
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...
CVE-2023-22720
CVE-2023-22720 affects the WordPress plugin WP Links Page by Robert Macchi. Versions ≤ 4.9.3 are vulnerable to a Stored XSS due to inadequate input handling. The vulnerability impact is described in the CVE as cross-site scripting, with a PatchSTACK entry noting the fix in version 4.9.4 . No expl...
CVE-2023-2490
CVE-2023-2490 affects the WordPress plugin UserAgent-Spy (Fernando Briano)
PT-2023-22606 · Webkil · Webkul Qloapps
Name of the Vulnerable Software and Affected Versions: Webkil QloApps version 1.5.2 Description: A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via the back and email create parameters in the AuthController.php file. Recommendations: For Webkil QloApps versi...
CVE-2022-47606 WordPress WP-CORS Plugin <= 0.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tim Stephenson WP-CORS plugin = 0.2.1 versions...
CVE-2022-27856
CVE-2022-27856 is a stored XSS vulnerability in the WordPress Atlas Gondal Export All URLs plugin, affecting versions
CVE-2022-47423
CVE-2022-47423 pertains to the WordPress WP-dTree plugin, affected versions are ≤ 4.4.5. The root cause is a Stored XSS flaw in plugin settings due to insufficient sanitization/escaping, allowing admin+ users to inject malicious content. Public sources corroborate admin-level exposure and note th...
CVE-2022-47436
CVE-2022-47436 is a Stored XSS affecting the WordPress plugin Yatra (Best Travel Booking WordPress Plugin) by MantraBrain. Public details confirm the vulnerability exists in Yatra versions through 2.1.14 and that a fix is available in version 2.1.15. The root cause is improper neutralization of i...
CVE-2023-30746
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Booqable Rental Software Booqable Rental plugin = 2.4.15 versions...
CVE-2023-22696
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Custom4Web Affiliate Links Lite plugin = 2.5 versions...
CVE-2022-33961
CVE-2022-33961 is an admin+ authenticated Stored XSS in the WordPress YellowPencil Visual CSS Style Editor plugin (
CVE-2022-32970 WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)
Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Themify Themify Portfolio Post plugin = 1.2.4 versions...