25221 matches found
CVE-2025-1526
The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget countdown feature in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2025-2325
The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...
CVE-2025-2325 WP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...
CVE-2025-2325
CVE-2025-2325 affects the WordPress plugin WP Test Email. The vulnerability is an unauthenticated stored XSS via Email Logs in all versions up to 1.1.8, caused by insufficient input sanitization and output escaping. Exploitation could inject scripts that execute when users load injected pages. Th...
CVE-2025-2325 WP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...
CVE-2025-1773
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2025-1773
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2024-13497
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possib...
CVE-2024-13497 WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.9 - Unauthenticated Stored Cross-Site Scripting
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possib...
CVE-2025-1773 Traveler <= 3.1.8 - Reflected Cross-Site Scripting
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2025-1773 Traveler <= 3.1.8 - Reflected Cross-Site Scripting
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2025-1773
CVE-2025-1773 affects the WordPress Traveler theme (
CVE-2025-2164
The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'postid' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-13847
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2025-2164 pixelstats <= 0.8.2 - Reflected Cross-Site Scripting
The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'postid' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2025-2164
CVE-2025-2164 affects the WordPress plugin pixelstats (
CVE-2025-2164 pixelstats <= 0.8.2 - Reflected Cross-Site Scripting
The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'postid' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-13847
CVE-2024-13847 (Red Hat RH advisory) concerns a stored XSS vulnerability in the WordPress Portfolio and Projects plugin, affecting all versions up to 1.5.3. It requires authenticated administrators (Administrator-level) and affects multisite installs or sites with unfiltered_html disabled. The pu...