PT-2022-16459 · WordPress · Rough Chart Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Rough Chart WordPress plugin versions through 1.0.0 Description: The issue concerns the Rough Chart WordPress plugin, which does not properly escape chart data labels. This could allow high-privilege users to perform Cross-Site Scripting...

CVE-2022-2412: Improper Neutralization of Input During Web Page Generation

The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2423: Improper Neutralization of Input During Web Page Generation

The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

Testimonial Builder < 1.6.2 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2410: Improper Neutralization of Input During Web Page Generation

The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2395: Improper Neutralization of Input During Web Page Generation

The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-16557

Name of the Vulnerable Software and Affected Versions Google Maps Anywhere WordPress plugin versions 1.2.6.3 and earlier Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example...

Cross site scripting

The Featured Image from URL FIFU WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite...

Cross site scripting

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0598 Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-15809 · WordPress · Wordpress Popup

Name of the Vulnerable Software and Affected Versions: WordPress Popup WordPress plugin versions 1.9.3.8 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in...

CVE-2022-2278: Improper Neutralization of Input During Web Page Generation

The Featured Image from URL FIFU WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite...

PT-2022-13293 · WordPress · Login With Phone Number

Name of the Vulnerable Software and Affected Versions: Login with phone number WordPress plugin versions prior to 1.3.8 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape its settings, even when the...

PT-2022-15917 · WordPress · Invitation Based Registrations

Name of the Vulnerable Software and Affected Versions: Invitation Based Registrations WordPress plugin versions 2.2.84 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed,...

CVE-2022-0598: Improper Neutralization of Input During Web Page Generation

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-2328: Improper Neutralization of Input During Web Page Generation

The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-2170: Improper Neutralization of Input During Web Page Generation

The Microsoft Advertising Universal Event Tracking UET WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Due to the nature of this...

Cross site scripting

The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-15981

Name of the Vulnerable Software and Affected Versions The Simple Page Transition WordPress plugin versions 1.4.1 and earlier Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for...

CVE-2022-2239: Undefined Security Weakness

The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...