CVE-2022-42485

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin = 6.0 versions...

CVE-2023-1155

The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ndccmetaboxccpriceicon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2022-44590

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in James Lao's Simple Video Embedder plugin = 2.2 on WordPress...

CVE-2022-38460

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in NOTICE BOARD plugin = 1.1 at WordPress...

Cross site scripting

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in NOTICE BOARD plugin = 1.1 at WordPress...

CVE-2022-37339

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

Cross site scripting

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in WHA Crossword plugin = 1.1.10 at WordPress...

CVE-2022-36355

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...

CVE-2022-25604

Authenticated contributor of higher user role Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Price Table plugin versions = 0.2.2...

Shortcodes Ultimate <= 5.0.0 - Authenticated Contributor Code Execution

The Shortcodes Ultimate plugin does not sanitize the "filter" argument to the "sumeta", "suuser", and "supost" shortcodes, allowing the filter to be set to the "system" function which runs arbitrary code. This is being exploited in the wild; I discovered this though analysis of modsecurity audit...