CVE-2026-78849

A Cross Site Scripting (XSS) vulnerability exists in Netgate pfSense Plus software (versions <= 26.03) and pfSense CE software (versions

CVE-2024-10360: Exposure of Sensitive Information to an Unauthorized Actor

The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render function in includes/widgets/accordion/widget.php, includes/widgets/remote-template/widget.php, and other widget.php files. This makes it...

CVE-2021-38322: Improper Neutralization of Input During Web Page Generation

The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1...

PT-2021-22040

Name of the Vulnerable Software and Affected Versions: Twitter Friends Widget WordPress plugin versions up to and including 3.1 Description: The issue allows attackers to inject arbitrary web scripts via the pmc TF user and pmc TF password parameters found in the /twitter-friends-widget.php file...

PT-2021-10308

Name of the Vulnerable Software and Affected Versions: pfSense versions 2.4.4-p2 and earlier Description: An authenticated Cross-Site Scripting issue was found in the pfSense software WebGUI. The descr description parameter of wake-on-LAN entries in the widgets/widgets/wake on lan widget.php...

PT-2018-14245

Name of the Vulnerable Software and Affected Versions Gwolle Guestbook gwolle-gb plugin versions prior to 2.5.4 Description A security issue exists in the admin/gb-dashboard-widget.php file of the Gwolle Guestbook plugin for WordPress. This issue can be exploited via the PATH INFO to...

CVE-2018-17884: Improper Neutralization of Input During Web Page Generation

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook gwolle-gb plugin before 2.5.4 for WordPress via the PATHINFO to wp-admin/index.php...

CVE-2013-0721: Exposure of Sensitive Information to an Unauthorized Actor

wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message...

CVE-2012-1835: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to app/view/agenda-widget-form.php; 2 args, 3 title, 4 beforetitle, or 5 aftertitle parameter...

PT-2012-3579

Name of the Vulnerable Software and Affected Versions All-in-One Event Calendar plugin versions 1.4 and 1.5 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various parameter...

PT-2010-5479

Name of the Vulnerable Software and Affected Versions The Register Plus plugin versions 3.5.1 and earlier Description The issue allows remote attackers to obtain sensitive information via a direct request to "dash widget.php" and "register-plus.php", which reveals the installation path in an erro...