CVE-2022-46844: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in PixelGrade PixFields plugin = 0.7.0 versions...

CVE-2023-23862: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Vertical scroll recent post plugin = 14.0 versions...

CVE-2023-23668: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in GiveWP plugin = 2.25.1 versions...

CVE-2023-24408: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin = 6.11.4 versions...

CVE-2023-24400: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Hu-manity.Co Cookie Notice & Compliance for GDPR / CCPA plugin = 2.4.6 versions...

CVE-2022-45818: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin = 1.3.4 versions...

CVE-2023-25982: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Eirudo Simple YouTube Responsive plugin = 2.5 versions...

CVE-2023-23876: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TMS-Plugins wpDataTables plugin = 2.1.49 versions...

CVE-2023-23820: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in ProfilePress Membership Team ProfilePress plugin = 4.5.4 versions...

CVE-2023-23708: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin = 3.9.4 versions...

CVE-2023-22713: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin = 2.1.8 versions...

CVE-2023-23866: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Carlos Moreira Interactive Geo Maps plugin = 1.5.8 versions...

CVE-2023-23717: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in George Gecewicz Portfolio Slideshow plugin = 1.13.0 versions...

CVE-2023-23832: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in TC Ultimate WP Query Search Filter plugin = 1.0.10 versions...

CVE-2023-23827: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Google Maps v3 Shortcode plugin = 1.2.1 versions...

CVE-2022-45839: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WHA WHA Puzzle plugin = 1.0.9 versions...

Ultimate Carousel For WPBakery Page Builder <= 2.6 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The plugin author was made aware of this...

Locatoraid Store Locator < 3.9.15 - Contributor+ Stored Cross-Site Scripting

The plugin does not properly sanitize input and escape output in its shortcodes, leading to stored cross-site scripting vulnerabilities for authenticated users with contributor-level permissions or higher...

CVE-2023-0546: Undefined Security Weakness

The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to...

CVE-2023-27620: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-site Scripting XSS vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin = 3.2.12 versions...