Lucene search
+L

269438 matches found

Nuclei
Nuclei
added 8 hours ago17 views

WordPress TS Poll < 2.4.0 - SQL Injection

WordPress TS Poll plugin 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges. id: CVE-2024-8625 info: name: WordPress TS Poll 2.4.0 - SQL...

7.2CVSS5.6AI score0.02342EPSS
SaveExploits1References2
Nuclei
Nuclei
added 8 hours ago9 views

LatePoint <= 5.0.12 - Authentication Bypass

LatePoint plugin for WordPress versions up to 5.0.12 contains an authentication bypass caused by insufficient verification of user during booking, letting unauthenticated attackers log in as any existing user if they have user ID access, exploit requires access to user ID, and the 'Use WordPress...

9.8CVSS5.5AI score0.03054EPSS
SaveExploits0References3
Nuclei
Nuclei
added 8 hours ago30 views

NewsTicker <= 1.0 - Reflected Cross-Site Scripting

NewsTicker WordPress plugin v1.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft a maliciou...

6.1CVSS7.7AI score0.00579EPSS
SaveExploits1References2
Nuclei
Nuclei
added 8 hours ago92 views

Newsletter < 7.6.9 - Cross-Site Scripting

The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators id: CVE-2023-27922 info: name: Newsletter 7.6.9 - Cross-Site Scripting author: r3Y3r53 severity: medium...

6.1CVSS6.2AI score0.01198EPSS
SaveExploits1References4
Nuclei
Nuclei
added 8 hours ago74 views

Ninja Forms < 3.6.26 - Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin id: CVE-2023-37979 info: name: Ninja Forms 3.6.26 - Cross-Site Scripting author: r3Y3r53 severity:...

7.1CVSS7.2AI score0.09707EPSS
SaveExploits6References5
Nuclei
Nuclei
added 8 hours ago42 views

Woo Bulk Price Update <2.2.2 - Cross-Site Scripting

The Woo Bulk Price Update WordPress plugin, in versions 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the technogetproducts action, which can only be triggered by an authenticated user. id: CVE-2023-28665 info: name: Woo Bulk Price Update 2.2.2 -...

5.4CVSS5.6AI score0.00887EPSS
SaveExploits2References4
Nuclei
Nuclei
added 8 hours ago70 views

Tablesome < 1.0.9 - Cross-Site Scripting

Tablesome before 1.0.9 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

6.1CVSS6.2AI score0.01067EPSS
SaveExploits3References3
Nuclei
Nuclei
added 8 hours ago107 views

Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection

The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query. id: CVE-2023-0630 info: name: Slimstat Analytics 4.9.3.3 Subscriber - SQL Injection author: DhiyaneshDK severity: high description...

8.8CVSS7.9AI score0.05141EPSS
SaveExploits3References5
Nuclei
Nuclei
added 8 hours ago74 views

WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting

WordPress Watu Quiz plugin before 3.3.9.1 is susceptible to cross-site scripting. The plugin does not sanitize and escape some parameters, such as email, dn, date, and points, before outputting then back in a page. An attacker can inject arbitrary script in the browser of an unsuspecting user in...

6.1CVSS6.1AI score0.01252EPSS
SaveExploits3References5
Nuclei
Nuclei
added 8 hours ago103 views

WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection

WordPress Easy Digital Downloads plugin 3.1.0.2 and 3.1.0.3 contains a SQL injection vulnerability in the s parameter of its edddownloadsearch action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

9.8CVSS8.1AI score0.11172EPSS
SaveExploits2References5
Nuclei
Nuclei
added 8 hours ago82 views

WordPress GN Publisher <1.5.6 - Cross-Site Scripting

WordPress GN Publisher plugin before 1.5.6 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...

6.1CVSS6.6AI score0.0126EPSS
SaveExploits3References5
Nuclei
Nuclei
added 8 hours ago98 views

WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting

WordPress Ultimate FAQ plugin before 1.8.30 is susceptible to cross-site scripting via DisplayFAQ to Shortcodes/DisplayFAQs.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.2AI score0.02195EPSS
SaveExploits1References5
Nuclei
Nuclei
added 8 hours ago58 views

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

6.1CVSS6.2AI score0.01347EPSS
SaveExploits2References3
Nuclei
Nuclei
added 8 hours ago113 views

WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting

WordPress Japanized for WooCommerce plugin before 2.5.5 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This...

6.1CVSS6.6AI score0.01213EPSS
SaveExploits3References5
Nuclei
Nuclei
added 8 hours ago76 views

WordPress Time Capsule < 1.21.16 - Authentication Bypass

WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWPJSONPREFIX causes the client to be logged in as the first account on the list of administrator accounts. id: CVE-2020-8771 info: name: WordPress Time Capsule 1.21.16 - Authentication...

9.8CVSS7.6AI score0.46454EPSS
SaveExploits2References5
Nuclei
Nuclei
added 8 hours ago11 views

SureForms <= 1.13.1 - Sensitive Information Exposure

SureForms WordPress plugin = 1.13.1 contains a sensitive information exposure caused by setting 'authcallback' to 'returntrue' in 'srfmemailnotification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication. id:...

7.5CVSS5.4AI score0.01986EPSS
SaveExploits0References2
Nuclei
Nuclei
added 8 hours ago46 views

Widget4Call WordPress - Cross-Site Scripting

Widget4Call WordPress plugin = 1.0.7 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13099 info: name:...

5.4CVSS7.7AI score0.0068EPSS
SaveExploits1References1
Nuclei
Nuclei
added 8 hours ago14 views

WP MediaTagger <= 4.1.1 - Cross-Site Scripting

WP MediaTagger WordPress plugin = 4.1.1 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires user interaction or victim to visit a malicious link. id:...

6.1CVSS7.5AI score0.00582EPSS
SaveExploits1References2
Nuclei
Nuclei
added 8 hours ago18 views

Tutor LMS <= 2.1.10 - SQL Injection

Tutor LMS – eLearning and online course solution plugin for WordPress all versions up to 2.6.1 contains a time-based SQL Injection caused by insufficient escaping on the questionid parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive...

8.8CVSS8.1AI score0.03109EPSS
SaveExploits0References3
Nuclei
Nuclei
added 8 hours ago21 views

Musicbox WordPress - Reflected XSS

contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13327 info:...

6.1CVSS7.5AI score0.00562EPSS
SaveExploits1References2
Rows per page
Query Builder