Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker who has the…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
CVSS
6,4
EPSS
0,19 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker who has the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
6,4
0,19 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.