16149 matches found
CVE-2025-68891
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ryan Sutana WP App Bar wp-app-bar allows Reflected XSS.This issue affects WP App Bar: from n/a through = 1.5...
CVE-2023-4290
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHPSELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin...
CVE-2023-4933
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled...
CVE-2016-10946
The wp-d3 plugin before 2.4.1 for WordPress has CSRF...
CVE-2016-10878
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS...
CVE-2016-10875
The wp-database-backup plugin before 4.3.1 for WordPress has XSS...
CVE-2016-10990
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header...
CVE-2016-10936
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option...
CVE-2016-10901
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools...
CVE-2022-38702
Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0...
CVE-2022-0788
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users...
CVE-2022-0429
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability...
CVE-2022-0874
The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-0826
The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users...
CVE-2022-0321
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the postid parameter before outputting it back in the response via the wpvcsocialshareicons AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...
CVE-2017-18567
The wp-all-import plugin before 3.4.6 for WordPress has XSS...
CVE-2017-18515
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...
CVE-2017-18568
The my-wp-translate plugin before 1.0.4 for WordPress has XSS...
CVE-2019-11185
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file...