CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks...

5.4CVSS6.1AI score0.00399EPSS

Exploits2References1

RedhatCVE•added 2025/05/22 10:12 p.m.•6 views

CVE-2022-1755

The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks...

5.4CVSS6.2AI score0.00513EPSS

Exploits1References1

RedhatCVE•added 2025/05/22 9:4 p.m.•26 views

CVE-2021-24163

The AJAX action, wpajaxninjaformssendwpremoteinstallhandler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form...

8.8CVSS6.8AI score0.01439EPSS

Exploits2References1

RedhatCVE•added 2025/05/22 9:3 p.m.•19 views

CVE-2021-24164

In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wpajaxnfoauth, and retrieve the connection url needed to establish a connection. They could also retrieve the clientid for an already established OAuth connecti...

4.3CVSS6.8AI score0.00889EPSS

Exploits2References1