PT-2022-13371

Name of the Vulnerable Software and Affected Versions SEO 301 Meta WordPress plugin versions 1.9.1 and earlier Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks by exploiting unescaped Request and Destination settings in the plugin, even wh...

PT-2022-13370

Name of the Vulnerable Software and Affected Versions Simple Tracking WordPress plugin versions prior to 1.7 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its...

PT-2022-13357

Name of the Vulnerable Software and Affected Versions WP Home Page Menu WordPress plugin versions prior to 3.1 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its...

PT-2022-9536

Name of the Vulnerable Software and Affected Versions Error Log Viewer WordPress plugin versions prior to 1.1.2 Description The issue allows high privilege users to clear arbitrary files on the web server, including those outside of the blog folder, due to a lack of validation of the log file pat...

PT-2022-9494

Name of the Vulnerable Software and Affected Versions Cybersoldier WordPress plugin versions prior to 1.7.0 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of URL settings before outputting them in an attribute...

CVE-2021-25026: Improper Neutralization of Input During Web Page Generation

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13348

Name of the Vulnerable Software and Affected Versions Kunze Law WordPress plugin versions prior to 2.1 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly escape its 'E-Mail Error "From"...

PT-2022-9554

Name of the Vulnerable Software and Affected Versions HTML5 Responsive FAQ WordPress plugin versions 2.8.5 and earlier Description The issue concerns the improper sanitization and escaping of certain settings in the plugin, potentially allowing high-privilege users to perform Cross-Site Scripting...

CVE-2022-0420

The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rmformid parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks...

CVE-2022-0535

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0389

The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Sql injection

The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rmformid parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks...

Cross site scripting

The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

Cross site scripting

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24810 WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting

The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24810: Improper Neutralization of Input During Web Page Generation

The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0535: Improper Neutralization of Input During Web Page Generation

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0420: Improper Neutralization of Special Elements used in an SQL Command

The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rmformid parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks...

CVE-2022-0389: Improper Neutralization of Input During Web Page Generation

The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...