15788 matches found
CVE-2025-0860
The VR-Frases collect & share quotes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2025-0861
CVE-2025-0861 affects the VR-Frases (collect & share quotes) WordPress plugin. The vulnerability is a SQL Injection in multiple parameters for all versions up to and including 3.0.1, caused by insufficient escaping and lack of proper query preparation. Unauthenticated attackers could append addit...
CVE-2024-13732
The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sectiontag’ parameter in all versions up to, and including, 1.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2024-13732
Vulnerability: Stored Cross-Site Scripting (XSS) in the Responsive Blocks – WordPress Gutenberg Blocks plugin (Responsive Blocks) up to version 1.9.9. Root cause: insufficient input sanitization and output escaping on the section_tag parameter. Impact: authenticated attackers with Contributor-lev...
CVE-2024-13732 Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag Parameter
The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sectiontag’ parameter in all versions up to, and including, 1.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2024-13732 Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag Parameter
The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sectiontag’ parameter in all versions up to, and including, 1.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2024-13470
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...
CVE-2024-13642
The CVE refers to WordPress Stratum – Elementor Widgets (Stratum) plugin, vulnerable to Stored Cross-Site Scripting via the Image Hotspot widget. The issue exists in all versions up to and including 1.4.7 and stems from insufficient input sanitization and output escaping on user-supplied attribut...
CVE-2024-12921
The EthereumICO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ethereum-ico shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-12400
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...
PT-2025-4076 · WordPress · Vr-Frases
Name of the Vulnerable Software and Affected Versions: VR-Frases plugin for WordPress versions up to, and including, 3.0.1 Description: The issue is related to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that...
PT-2025-2233 · WordPress · Stratum – Elementor Widgets
Name of the Vulnerable Software and Affected Versions: Stratum – Elementor Widgets plugin for WordPress versions up to, and including, 1.4.7 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Image Hotspot widget, allowing...
WordPress plugin Bulk Me Now! 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...
PT-2025-2251 · WordPress · Wp Image Uploader
Name of the Vulnerable Software and Affected Versions: WP Image Uploader plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Reflected Cross-Site Scripting via the file parameter due to insufficient input sanitization and output escaping. This allows...
PT-2025-1851 · WordPress · Wp Dispensary
Name of the Vulnerable Software and Affected Versions: WP Dispensary plugin for WordPress versions up to, and including, 4.5.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wpd menu' shortcode due to insufficient input sanitization and output escaping on...
GHSA-3XG3-CGVQ-2XWR Twig security issue where escaping was missing when using null coalesce operator
When using the ?? operator, output escaping was missing for the expression on the left side of the operator...
Twig security issue where escaping was missing when using null coalesce operator
When using the ?? operator, output escaping was missing for the expression on the left side of the operator...
CVE-2025-24374
Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0...