Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to, and including, 5.2.10 due to insufficient input sanitization and…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to, and including, 2.8.188 due to insufficient input…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_id' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
CVSS
6,4
EPSS
0,16 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to, and including, 5.2.10 due to insufficient input sanitization and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to, and including, 2.8.188 due to insufficient input…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_id' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
6,4
0,16 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.