Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43816 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-1549 1 Wp Athletics Project 1 Wp Athletics 2024-11-21 5.4 Medium
The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.
CVE-2022-1547 1 Wpchill 1 Check \& Log Email 2024-11-21 6.1 Medium
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2022-1546 1 Visser 1 Woocommerce - Product Importer 2024-11-21 6.1 Medium
The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVE-2022-1542 1 Justsystems 1 Hpb Dashboard 2024-11-21 4.8 Medium
The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVE-2022-1541 1 Richweb 1 Video Slider 2024-11-21 4.8 Medium
The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2022-1532 1 Themify 1 Woocommerce Product Filter 2024-11-21 6.1 Medium
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2022-1530 1 Livehelperchat 1 Live Helper Chat 2024-11-21 6.1 Medium
Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.
CVE-2022-1528 1 Vikwp 1 Vik Booking 2024-11-21 6.1 Medium
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
CVE-2022-1527 1 Wpwhitesecurity 1 Wp 2fa 2024-11-21 6.1 Medium
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2022-1514 1 Facturascripts 1 Facturascripts 2024-11-21 5.4 Medium
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
CVE-2022-1512 1 Scrollrevealjs-effects Project 1 Scrollrevealjs-effects 2024-11-21 4.8 Medium
The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2022-1506 1 Wp Born Babies Project 1 Wp Born Babies 2024-11-21 5.4 Medium
The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
CVE-2022-1504 1 Microweber 1 Microweber 2024-11-21 6.1 Medium
XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
CVE-2022-1494 1 Google 1 Chrome 2024-11-21 6.1 Medium
Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page.
CVE-2022-1492 1 Google 1 Chrome 2024-11-21 6.1 Medium
Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page.
CVE-2022-1474 1 Wp-eventmanager 1 Wp Event Manager 2024-11-21 6.1 Medium
The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting
CVE-2022-1470 1 Ultimate Woocommerce Csv Importer Project 1 Ultimate Woocommerce Csv Importer 2024-11-21 6.1 Medium
The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVE-2022-1469 1 Fibosearch 1 Fibosearch 2024-11-21 4.8 Medium
The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
CVE-2022-1465 1 Wpclever 1 Wpc Smart Wishlist For Woocommerce 2024-11-21 6.1 Medium
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
CVE-2022-1464 1 Gogs 1 Gogs 2024-11-21 5.4 Medium
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .