CVE-2021-24895

The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24966

The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder...

Cross site scripting

The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Path traversal

The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder...

Cross site scripting

The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13348

Name of the Vulnerable Software and Affected Versions Kunze Law WordPress plugin versions prior to 2.1 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly escape its 'E-Mail Error "From"...

PT-2022-13371

Name of the Vulnerable Software and Affected Versions SEO 301 Meta WordPress plugin versions 1.9.1 and earlier Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks by exploiting unescaped Request and Destination settings in the plugin, even wh...

PT-2022-13370

Name of the Vulnerable Software and Affected Versions Simple Tracking WordPress plugin versions prior to 1.7 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its...

PT-2022-13372

Name of the Vulnerable Software and Affected Versions Petfinder Listings WordPress plugin versions 1.0.18 and earlier Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not escape its settings, even...

PT-2022-13357

Name of the Vulnerable Software and Affected Versions WP Home Page Menu WordPress plugin versions prior to 3.1 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its...

PT-2022-9554

Name of the Vulnerable Software and Affected Versions HTML5 Responsive FAQ WordPress plugin versions 2.8.5 and earlier Description The issue concerns the improper sanitization and escaping of certain settings in the plugin, potentially allowing high-privilege users to perform Cross-Site Scripting...

PT-2022-9536

Name of the Vulnerable Software and Affected Versions Error Log Viewer WordPress plugin versions prior to 1.1.2 Description The issue allows high privilege users to clear arbitrary files on the web server, including those outside of the blog folder, due to a lack of validation of the log file pat...

PT-2022-9494

Name of the Vulnerable Software and Affected Versions Cybersoldier WordPress plugin versions prior to 1.7.0 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of URL settings before outputting them in an attribute...

CVE-2022-0703: Improper Neutralization of Input During Web Page Generation

The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0701: Improper Neutralization of Input During Web Page Generation

The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0684: Improper Neutralization of Input During Web Page Generation

The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0674: Improper Neutralization of Input During Web Page Generation

The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0659: Improper Neutralization of Input During Web Page Generation

The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25026: Improper Neutralization of Input During Web Page Generation

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...