Total
36252 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-24035 | 1 Setorinformatica | 1 S.i.l. | 2025-05-13 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter. | |||||
| CVE-2020-36844 | 1 Knowbe4 | 1 Security Awareness Training | 2025-05-13 | N/A | 6.1 MEDIUM |
| The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to a JavaScript URL. | |||||
| CVE-2024-3751 | 1 Castos | 1 Seriously Simple Podcasting | 2025-05-13 | N/A | 4.8 MEDIUM |
| The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2024-3753 | 1 Kibokolabs | 1 Hostel | 2025-05-13 | N/A | 5.9 MEDIUM |
| The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2024-3919 | 1 Arnesonium | 1 Openpgp Form Encryption | 2025-05-13 | N/A | 4.6 MEDIUM |
| The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2024-3963 | 1 Rafflepress | 1 Giveaways And Contests | 2025-05-13 | N/A | 6.5 MEDIUM |
| The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks | |||||
| CVE-2024-3964 | 1 Wisdmlabs | 1 Product Enquiry For Woocommerce | 2025-05-13 | N/A | 5.9 MEDIUM |
| The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2025-0483 | 1 Native-php-cms Project | 1 Native-php-cms | 2025-05-13 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability has been found in Fanli2012 native-php-cms 1.0 and classified as problematic. This vulnerability affects unknown code of the file /fladmin/jump.php. The manipulation of the argument message/error leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-29772 | 1 Open-emr | 1 Openemr | 2025-05-13 | N/A | 6.1 MEDIUM |
| OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcategory is output to the page without being properly processed. This leads to a reflected cross-site scripting (XSS) vul;nerability in CAMOS new.php. This vulnerability is fixed in 7.0.3. | |||||
| CVE-2025-0613 | 1 10web | 1 Photo Gallery | 2025-05-13 | N/A | 6.1 MEDIUM |
| The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed | |||||
| CVE-2024-10558 | 1 10web | 1 Form Maker | 2025-05-13 | N/A | 3.5 LOW |
| The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-34241 | 1 Rocketsoft | 1 Rocket Lms | 2025-05-13 | N/A | 4.8 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications. | |||||
| CVE-2024-2218 | 1 Theluckywp | 1 Luckywp Table Of Contents | 2025-05-13 | N/A | 4.6 MEDIUM |
| The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2024-4271 | 1 Svgator | 1 Svgator | 2025-05-13 | N/A | 4.6 MEDIUM |
| The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. | |||||
| CVE-2024-3236 | 1 Ghozylab | 1 Popup Builder | 2025-05-13 | N/A | 5.4 MEDIUM |
| The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2024-4305 | 1 Wpxpo | 1 Postx | 2025-05-13 | N/A | 6.8 MEDIUM |
| The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2024-2369 | 1 Godaddy | 1 Coblocks | 2025-05-13 | N/A | 5.4 MEDIUM |
| The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2024-2263 | 1 Themify | 1 Woocommerce Product Filter | 2025-05-13 | N/A | 4.8 MEDIUM |
| Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2024-32325 | 1 Totolink | 2 Ex200, Ex200 Firmware | 2025-05-13 | N/A | 2.4 LOW |
| TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the ssid parameter in the setWiFiExtenderConfig function. | |||||
| CVE-2024-1846 | 1 Wpdarko | 1 Responsive Tabs | 2025-05-13 | N/A | 5.4 MEDIUM |
| The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||