Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43866 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-2412 1 Better Tag Cloud Project 1 Better Tag Cloud 2024-11-21 4.8 Medium
The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2411 1 Auto More Tag Project 1 Auto More Tag 2024-11-21 4.8 Medium
The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2410 1 Mtouch Quiz Project 1 Mtouch Quiz 2024-11-21 4.8 Medium
The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2409 1 Rough Chart Project 1 Rough Chart 2024-11-21 4.8 Medium
The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2407 1 Puvox 1 Wp Phpmyadmin 2024-11-21 4.8 Medium
The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2398 1 Najeebmedia 1 Wordpress Comments Fields 2024-11-21 4.8 Medium
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2022-2395 1 Weformspro 1 Weforms 2024-11-21 4.8 Medium
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2391 1 Wpzoom 1 Inspiro Pro 2024-11-21 5.4 Medium
The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.
CVE-2022-2386 1 Automattic 1 Crowdsignal Dashboard 2024-11-21 6.1 Medium
The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVE-2022-2384 1 Supsystic 1 Digital Publications By Supsystic 2024-11-21 4.8 Medium
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-2383 1 Slickremix 1 Feed Them Social 2024-11-21 6.1 Medium
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVE-2022-2378 1 Easy Student Results Project 1 Easy Student Results 2024-11-21 6.1 Medium
The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVE-2022-2375 1 Okapitech 1 Wp Sticky Button 2024-11-21 5.4 Medium
The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues
CVE-2022-2374 1 Nsqua 1 Simply Schedule Appointments 2024-11-21 4.8 Medium
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2372 1 Yaycommerce 1 Yaysmtp 2024-11-21 4.8 Medium
The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-2371 1 Yaycommerce 1 Yaysmtp 2024-11-21 5.4 Medium
The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.
CVE-2022-2365 1 Trilium Project 1 Trilium 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3.
CVE-2022-2361 1 Quadlayers 1 Wp Social Chat 2024-11-21 4.8 Medium
The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks.
CVE-2022-2351 1 Wpexperts 1 Post Smtp 2024-11-21 4.8 Medium
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
CVE-2022-2342 1 Getoutline 1 Outline 2024-11-21 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4.