Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar()…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including,…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including,…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
CVSS
7,1
EPSS
0,73 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar()…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
7,1
0,73 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjePrzetwarzanie niepełne
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.