9792 matches found
WordPress WP DataTable plugin <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by zaim in WordPress Plugin WP DataTable versions = 0.2.6...
PT-2025-2220 · WordPress · Wpdatatables
Name of the Vulnerable Software and Affected Versions: WP DataTable plugin for WordPress versions up to, and including, 0.2.6 Description: The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. This allows authenticated...
CVE-2024-13566: Improper Neutralization of Input During Web Page Generation
The WP DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 0.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
WordPress plugin WP DataTable has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...
CVE-2025-0739
An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's information of others users by changing the "SUSCBRIPTIONID" param of the endpoint "/demos/embedai/subscriptions/show/"...
WordPress plugin: WordPress Survey & Poll SQL injection vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WordPress...
CVE-2024-10628
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 Business, up to, and including, 21.8.0 Developer, and up to, and including, 31.8.0 Agency due to insufficient escaping on the user...
WordPress plugin Quiz Maker: Security vulnerabilities for businesses, developers, and agencies
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2024-10628: Improper Neutralization of Special Elements used in an SQL Command
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 Business, up to, and including, 21.8.0 Developer, and up to, and including, 31.8.0 Agency due to insufficient escaping on the user...
CVE-2024-13680: Improper Neutralization of Special Elements used in an SQL Command
The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CPEASYFORMWILLAPPEARHERE' shortcode in all versions up to, and including, 1.2.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...
CVE-2024-13236 Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection
The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collectionid' parameter in all versions up to, and including, 0.21.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
PT-2025-2083 · WordPress · Tainacan
Name of the Vulnerable Software and Affected Versions: Tainacan plugin for WordPress versions 0.21.12 and earlier Description: The issue arises from insufficient escaping on the user-supplied collection id parameter and a lack of sufficient preparation on the existing SQL query. This allows...
PT-2025-2243 · WordPress · Form Builder
Name of the Vulnerable Software and Affected Versions: Form Builder CP plugin for WordPress versions up to and including 1.2.41 Description: The issue is related to SQL Injection via the id parameter of the "CP EASY FORM WILL APPEAR HERE" shortcode. This is due to insufficient escaping on the...
CVE-2024-13406
The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feedid' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
ZZCMS injection vulnerability
ZZCMS is a content management system CMS by the ZZCMS team in China. An injection vulnerability exists in ZZCMS, which originates from an SQL injection vulnerability contained in the id parameter of the /index.php page...
CVE-2024-57030
Wegia 3.2.0 is vulnerable to Cross Site Scripting XSS in /geral/documentosfuncionario.php via the id parameter...
CVE-2025-0532
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/newsubmit.php. The manipulation of the argument mid leads to sql injection. It is possible to launch the attack remotely. The exploit h...
CVE-2024-57030
Wegia 3.2.0 is vulnerable to Cross Site Scripting XSS in /geral/documentosfuncionario.php via the id parameter...
CVE-2024-57030
Versions of Wegia prior to 3.2.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the /geral/documentos_funcionario.php endpoint. The root cause is the improper neutralization of input via the id parameter, which allows for the injection of malicious scripts. To remediate this issue, users ...
