Export limit exceeded: 364880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (364880 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-6668 | 1 Wpproking | 1 Profilepro | 2025-06-04 | 5.4 Medium |
| The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks | ||||
| CVE-2024-6708 | 1 Cozmoslabs | 1 Profile Builder | 2025-06-04 | 4.8 Medium |
| The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks. | ||||
| CVE-2024-7758 | 1 Stylishpricelist | 1 Stylish Price List | 2025-06-04 | 4.8 Medium |
| The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-8493 | 1 Stellarwp | 1 The Events Calendar | 2025-06-04 | 4.8 Medium |
| The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-8542 | 1 Wpeverest | 1 Everest Forms | 2025-06-04 | 4.8 Medium |
| The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-8617 | 1 Ays-pro | 1 Quiz Maker | 2025-06-04 | 4.8 Medium |
| The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-8619 | 1 Wp-dreams | 1 Ajax Search | 2025-06-04 | 4.8 Medium |
| The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-8620 | 1 Mappresspro | 1 Mappress | 2025-06-04 | 4.8 Medium |
| The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-8670 | 1 10web | 1 Photo Gallery | 2025-06-04 | 4.8 Medium |
| The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-4578 | 1 Dimdavid | 1 File Provider | 2025-06-04 | 9.8 Critical |
| The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection | ||||
| CVE-2024-9233 | 1 Gsplugins | 1 Logo Slider | 2025-06-04 | 4.3 Medium |
| The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2024-9390 | 1 Metagauss | 1 Registrationmagic | 2025-06-04 | 4.8 Medium |
| The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-9599 | 1 Ays-pro | 1 Popup Box | 2025-06-04 | 5.4 Medium |
| The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-9645 | 1 Pickplugins | 1 Post Grid | 2025-06-04 | 5.4 Medium |
| The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2025-4580 | 1 Dimdavid | 1 File Provider | 2025-06-04 | 4.3 Medium |
| The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2025-2247 | 1 Mantus667 | 1 Wp-pmanager | 2025-06-04 | 5.4 Medium |
| The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | ||||
| CVE-2025-2248 | 1 Mantus667 | 1 Wp-pmanager | 2025-06-04 | 5.4 Medium |
| The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks | ||||
| CVE-2025-27703 | 1 Absolute | 1 Secure Access | 2025-06-04 | 6.0 Medium |
| CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to a specific subset of privileged features in the console can elevate their permissions to access additional features in the console. The attack complexity is low, there are no preexisting attack requirements; the privileges required are high, and there is no user interaction required. The impact to system confidentiality is low, the impact to system integrity is high and the impact to system availability is low. | ||||
| CVE-2025-27706 | 1 Absolute | 1 Secure Access | 2025-06-04 | 3.4 Low |
| CVE-2025-27706 is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator visits the page. Attack complexity is low, there are no preexisting attack requirements, privileges required are high and active user interaction is required. There is no impact on confidentiality, the impact on integrity is low and there is no impact on availability. | ||||
| CVE-2025-46078 | 1 Huocms | 1 Huocms | 2025-06-04 | 5.3 Medium |
| HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server | ||||