CVE-2026-3424: Improper Control of Generation of Code

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

CVE-2025-56697

A Stored Cross-Site Scripting XSS vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1.0. Attackers can inject malicious scripts via the smyFeedbacks POST parameter in /users/home.php...

CVE-2025-56697

A Stored Cross-Site Scripting XSS vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1.0. Attackers can inject malicious scripts via the smyFeedbacks POST parameter in /users/home.php...

CVE-2025-56697

A Stored Cross-Site Scripting (XSS) vulnerability exists in Kashipara Computer Base Test v1.0 . The flaw is caused by insufficient cleanup of the smyFeedbacks POST parameter in the /users/home.php file, allowing attackers to inject malicious scripts. These scripts are then executed when viewing t...

CVE-2024-9926 Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form...

Information disclosure

The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings...

CVE-2022-2834

The CVE-2022-2834 entry concerns the WordPress Helpful plugin (versions before 4.5.26). The vulnerability arises because exported logs and feedbacks are stored in publicly accessible locations with guessable file names, enabling attackers to download them and potentially retrieve sensitive inform...

CVE-2022-2834 Helpful < 4.5.26 - Information Disclosure

The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings...

CVE-2020-10423

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-feedbacks.php by adding a question mark ? followed by the payload...