CVE-2022-45839: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WHA WHA Puzzle plugin = 1.0.9 versions...

Ultimate Carousel For WPBakery Page Builder <= 2.6 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The plugin author was made aware of this...

Locatoraid Store Locator < 3.9.15 - Contributor+ Stored Cross-Site Scripting

The plugin does not properly sanitize input and escape output in its shortcodes, leading to stored cross-site scripting vulnerabilities for authenticated users with contributor-level permissions or higher...

CVE-2023-0546: Undefined Security Weakness

The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to...

CVE-2023-27620: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-site Scripting XSS vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin = 3.2.12 versions...

CVE-2023-24378: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Codeat Glossary plugin = 2.1.27 versions...

CVE-2023-24411: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Kerry Kline BNE Testimonials plugin = 2.0.7 versions...

CVE-2023-24003: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Timersys WP Popups – WordPress Popup plugin = 2.1.4.8 versions...

CVE-2023-23891: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in OceanWP Ocean Extra plugin = 2.1.1 versions. Needs the OceanWP theme installed and activated...

CVE-2023-26536: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Jonk @ Follow me Darling Sptify Play Button for WordPress plugin = 2.05 versions...

CVE-2023-23977: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments plugin = 1.6.1 versions...

CVE-2023-23686: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Brett Shumaker Simple Staff List plugin = 2.2.2 versions...

CVE-2023-23685: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin = 2.8.10 versions...

CVE-2023-25040: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin = 5.12.6 versions...

CVE-2023-23681: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin = 4.0 versions...

CVE-2022-47602: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in JoomUnited WP Table Manager plugin = 3.5.2 versions...

CVE-2022-46848: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin = 3.9.1 versions...

CVE-2022-46855: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP Darko Responsive Pricing Table plugin = 5.1.6 versions...

CVE-2023-23864: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Michael Aronoff Very Simple Google Maps plugin = 2.8.4 versions...

CVE-2023-23728: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Winwar Media WP Flipclock plugin = 1.7.4 versions...