Archives: Reports
CVE ID:
CVE-2023-4772
WordPress Plugin
newsletter
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-08-16
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-4372
WordPress Plugin
litespeed-cache
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-08-14
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-4283
WordPress Plugin
embedpress
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-08-02
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-3051
WordPress Plugin
page-builder-by-azexo
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-05-05
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-2498
WordPress Plugin
go_pricing
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-05-02
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-2433
WordPress Plugin
yet-another-related-posts-plugin
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-05-01
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-2439
WordPress Plugin
userpro
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-04-26
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-2305
WordPress Plugin
download-manager
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-04-25
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-2304
WordPress Plugin
favorites
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-04-25
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-24408
WordPress Plugin
ecwid-shopping-cart
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-27
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-0589
WordPress Plugin
wp-image-carousel
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-19
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2020-36656
WordPress Plugin
ultimate-addons-for-gutenberg
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-18
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-23681
WordPress Plugin
image-hover-effects-visual-composer-extension
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-23688
WordPress Plugin
social-share-boost
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-23687
WordPress Plugin
youtube-shortcode
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-22711
WordPress Plugin
wp-listings
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-23685
WordPress Plugin
tlp-portfolio
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-23686
WordPress Plugin
simple-staff-list
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-22720
WordPress Plugin
wp-links-page
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-22717
WordPress Plugin
formcraft-form-builder
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-22721
WordPress Plugin
oi-yamaps
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-22702
WordPress Plugin
wpappninja
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-22698
WordPress Plugin
theme-blvd-responsive-google-maps
Vulnerability Type:
Cross-Site Scripting (XSS)
Date:
2023-01-12
The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.
CVE ID:
CVE-2023-0220
WordPress Plugin
booking-system
Vulnerability Type:
SQL Injection
Date:
2023-01-11
The plugin contains an SQL Injection vulnerability due to the plugin does not properly sanitize and escape the lang attribute in the dopbs shortcode before using it in an SQL query, which makes it possible for authenticated attackers with a role as low as contributor to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE ID:
CVE-2023-23726
WordPress Plugin
tickera-event-ticketing-system
Vulnerability Type:
Missing Authorization
Date:
2023-01-11
The plugin contains a Missing Authorization vulnerability due to a missing capability check in the change_ticket_status AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to update arbitrary post status.