CVE-2023-24411: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Kerry Kline BNE Testimonials plugin = 2.0.7 versions...

CVE-2023-24378: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Codeat Glossary plugin = 2.1.27 versions...

CVE-2023-24003: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Timersys WP Popups – WordPress Popup plugin = 2.1.4.8 versions...

CVE-2023-26536: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Jonk @ Follow me Darling Sptify Play Button for WordPress plugin = 2.05 versions...

CVE-2023-23686

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Brett Shumaker Simple Staff List plugin = 2.2.2 versions...

CVE-2023-23686: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Brett Shumaker Simple Staff List plugin = 2.2.2 versions...

CVE-2023-23685: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin = 2.8.10 versions...

CVE-2023-23977: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments plugin = 1.6.1 versions...

CVE-2023-25040: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin = 5.12.6 versions...

CVE-2023-23681: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin = 4.0 versions...

CVE-2022-47602: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in JoomUnited WP Table Manager plugin = 3.5.2 versions...

CVE-2022-46848: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin = 3.9.1 versions...

CVE-2022-46855: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP Darko Responsive Pricing Table plugin = 5.1.6 versions...

CVE-2023-23864: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Michael Aronoff Very Simple Google Maps plugin = 2.8.4 versions...

CVE-2023-23728: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Winwar Media WP Flipclock plugin = 1.7.4 versions...

CVE-2022-45843: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin = 3.5.1.9 versions...

CVE-2022-42485: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin = 6.0 versions...

CVE-2022-41831: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin = 3.1.2 versions...

CVE-2023-1155 Cost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ndccmetaboxccpriceicon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2022-4757: Undefined Security Weakness

The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...