16557 matches found
CVE-2024-13690
The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2024-13690 WP Church Donation <= 1.7 - Unauthenticated Stored Cross-Site Scripting
The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2024-13690 WP Church Donation <= 1.7 - Unauthenticated Stored Cross-Site Scripting
The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
Malicious code in wp-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 800c16446b0d2da2bbffd5fc0a71b0811782c10cfdae89a9e7a9a6c946c5e1a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2721 Malicious code in wp-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 800c16446b0d2da2bbffd5fc0a71b0811782c10cfdae89a9e7a9a6c946c5e1a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress WP-Recall plugin < 16.26.12 - Admin+ SQL Injection vulnerability
Admin+ SQL Injection vulnerability discovered by y4ng0615 in WordPress Plugin WP-Recall versions 16.26.12...
CVE-2024-9770
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-11503
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-9770 WP-Recall < 16.26.12 - Admin+ SQL Injection
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-9770 WP-Recall < 16.26.12 - Admin+ SQL Injection
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-9770
CVE-2024-9770 concerns the WordPress plugin WP-Recall (before version 16.26.12). The issue stems from not sanitizing/escaping a parameter before using it in a SQL statement, enabling an admin-level SQL injection as described across multiple sources (NVD/Red Hat/CVE records). The vulnerability aff...
CVE-2024-11503
WP Tabs for WordPress is affected by CVE-2024-11503: versions before 2.2.7 do not sanitise/escape certain settings, allowing stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). The issue is documented across NVD, Red Hat, CVE records, and r...
CVE-2024-11503 WP Tabs < 2.2.7 - Admin+ Stored XSS
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-11503 WP Tabs < 2.2.7 - Admin+ Stored XSS
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-10554 WP-Advanced-Search < 3.3.9.3 - Admin+ Stored XSS
The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...
WordPress WP Compress plugin <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function vulnerability
Unauthenticated Server-Side Request Forgery via init Function vulnerability discovered by mikemyers in WordPress Plugin WP Compress versions = 6.30.15...
WordPress plugin WP Compress 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...
PT-2025-12741 · WordPress · Wp-Advanced-Search
Name of the Vulnerable Software and Affected Versions: WP-Advanced-Search versions prior to 3.3.9.3 Description: The issue concerns the WordPress WP-Advanced-Search plugin, where some settings are not properly sanitized and escaped. This could allow high-privilege users, such as admins, to perfor...
WordPress plugin WP-Recall 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...