323104 matches found
WordPress GeoDirectory cross-site scripting vulnerability
WordPress GeoDirectory versions 2.8.190 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postimages fileinfo2 = title' parameter. It may lead to storage-based cross-site scripting attacks. Certified...
WordPress PeproDev Branches Map: Cross-site Scripting Vulnerabilities
WordPress PeproDev branches map 3.0.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with privileges of contributor or higher to inject any web script into the page, making...
WordPress GeoDirectory cross-site scripting vulnerability
WordPress GeoDirectory 2.8.190 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. Certified attackers with subscription-level or higher permissions can inject any web script into pages through the...
WordPress Push Notification for Posts and BuddyPress: Authorization Issues Vulnerability
WordPress push notification for posts and BuddyPress versions 3.23 and earlier have a permission-related vulnerability. This vulnerability stems from the absence of proper permissions, which may allow attackers to exploit incorrectly configured access control levels...
WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Cross-site Script Vulnerability
WordPress Social Share Buttons & Analytics Plugin – GetSocial.io versions 4.5 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of response parameter inputs and improper output escaping, allowing authenticated attackers to inject arbitrary web...
WordPress Post Export Import with Media: Deserialization Injection Vulnerability
WordPress Post Export Import with Media has a deserialization injection vulnerability in versions 1.17.1 and earlier. This vulnerability stems from the deserialization processing of untrusted inputs, leading to PHP object injection. Certified attackers with administrator or higher privileges may ...
WordPress Gallery Custom Links: Cross-site Scripting Vulnerabilities
WordPress Gallery Custom Links versions 2.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the displayname profile.php and comment wp-comments-post.php parameters. Certified attackers with subscription and...
WordPress Countdown Timer – Widget Countdown plugin 3.0.0-3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Widget Countdown versions 3.0.0-3.0.1...
WordPress AnyComment plugin <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kevin Whelan in WordPress Plugin AnyComment versions = 0.3.6...
WordPress WooCommerce Bookings plugin < 3.11.0 - Unauthenticated Denial of Service vulnerability
Unauthenticated Denial of Service vulnerability discovered by Mike Gozdiskowski in WordPress Plugin WooCommerce Bookings versions 3.11.0...
WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Bit Integrations versions = 2.10.6...
WordPress Database Addon for Contact Form 7 – CFDB7 plugin <= 1.4.1 - Unauthenticated Limited File Deletion vulnerability
Unauthenticated Limited File Deletion vulnerability discovered by Sawyer in WordPress Plugin Contact Form 7 Database Addon – CFDB7 versions = 1.4.1...
WordPress BP Profile Search plugin <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution vulnerability
Unauthenticated Local File Inclusion to Remote Code Execution vulnerability discovered by snr in WordPress Plugin BP Profile Search versions = 5.9...
WordPress Click to Chat – HoliThemes plugin <= 4.44 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Click to Chat versions = 4.44...
WordPress Booking Package plugin <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by afei in WordPress Plugin Booking Package versions = 1.7.29...
WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.10.6 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by crow in WordPress Plugin Bit Integrations versions = 2.10.6...
WordPress Membership & User Roles for WooCommerce (Automatic Role Changer) plugin <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache vulnerability
Authenticated Subscriber+ Privilege Escalation to Stale Foreign Role Cache vulnerability discovered by Azgnt in WordPress Plugin DFX Automatic Role Changer for WooCommerce versions = 20260828...
WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Ozisti versions = 1.1.10...