Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all versions up to, and including, 1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Simple Donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's simpledonate shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including, 0.1. This is due to the plugin not properly sanitizing user input and output of the 'title' and 'text' parameters. This makes it possible…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3.1. This is due to the plugin not properly sanitizing user input and output of the 'width' and 'height' parameters. This makes it possible…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Precise Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wrap_id` shortcode attribute in all versions up to, and including, 1.0. This is due to the plugin not properly sanitizing user input or escaping output when inserting the wrapper ID into the generated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
CVSS
6,4
EPSS
0,19 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all versions up to, and including, 1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Simple Donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's simpledonate shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including, 0.1. This is due to the plugin not properly sanitizing user input and output of the 'title' and 'text' parameters. This makes it possible…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3.1. This is due to the plugin not properly sanitizing user input and output of the 'width' and 'height' parameters. This makes it possible…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Precise Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wrap_id` shortcode attribute in all versions up to, and including, 1.0. This is due to the plugin not properly sanitizing user input or escaping output when inserting the wrapper ID into the generated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
6,4
0,19 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.