319 matches found
CVE-2023-7196
The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-13383
The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-12680
The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-7195
The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...
CVE-2023-6783
The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-5529
The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-3996
The Smart Post Show WordPress plugin (specifically versions prior to 2.4.28 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitise and escape certain settings, which allows high-privilege users, such as administrators, to perform XSS attacks. This vulnera...
CVE-2024-9599
The Popup Box WordPress plugin versions prior to 4.7.8 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks, even in enviro...
CVE-2024-9236 Team Members Showcase < 4.4.2 - Editor+ Stored XSS
The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-8050 Custom Author Base <= 1.1.1 - Settings Update via CSRF
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-10362 Social Media Share Buttons < 2.9.0 - Admin+ Stored XSS
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...
CVE-2024-10362
The Social Media Share Buttons & Social Sharing Icons WordPress plugin, in versions prior to 2.9.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as administr...
CVE-2024-10144
The Rbs Image Gallery WordPress plugin (versions prior to 3.2.22 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape certain plugin settings, which allows high-privilege users, such as contributors , to perform XSS attacks. T...
WordPress plugin WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin WP ERP | Complete HR solution...
CVE-2025-46750
The CVE-2025-46750 issue affects SEL BIOS packages, specifically prior to 1.3.49152.117 and prior to 2.6.49152.98. The vulnerability allows a local attacker to bypass password authentication and modify password‑protected BIOS settings by importing a BIOS settings file that has no password. This i...
CVE-2025-37771
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Prevent division by zero The user can set any speed value. If speed is greater than UINTMAX/8, division by zero is possible. Found by Linux Verification Center linuxtesting.org with SVACE...
The vulnerability of the LockOpcSettings method in the software for managing and monitoring remote devices in telemetry and telemechanics systems allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the LockOpcSettings method in the software for managing and monitoring remote devices in telemetry and telemechanics systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the...
📄 WordPress Buddypress Humanity 1.2 Cross Site Request Forgery
WordPress Buddypress Humanity plugin versions 1.2 and below suffer from a cross site request forgery vulnerability. ⚠️ CVE-2025-31033 - CSRF in WordPress Buddypress Humanity Plugin...
CVE-2024-13898 Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output...