Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43840 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-6511 1 Finecms Project 1 Finecms 2025-05-05 6.1 Medium
andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php.
CVE-2022-40183 1 Bosch 2 Videojet Multi 4000, Videojet Multi 4000 Firmware 2025-05-05 5.8 Medium
An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user.
CVE-2024-0973 1 Patelmilap 1 Widget For Social Page Feeds 2025-05-05 6.1 Medium
The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2024-1401 1 Awplife 1 Profile Box Shortcode And Widget 2025-05-05 4.8 Medium
The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2021-34643 1 Skaut-bazar Project 1 Skaut-bazar 2025-05-05 6.1 Medium
The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2.
CVE-2023-7246 1 Bowo 1 System Dashboard 2025-05-05 5.4 Medium
The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks
CVE-2021-34644 1 Multiplayer-plugin Project 1 Multiplayer-plugin 2025-05-05 6.1 Medium
The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multiplayergames.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.7.
CVE-2021-34642 1 Followistic 1 Smart Email Alerts 2025-05-05 6.1 Medium
The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10.
CVE-2021-34652 1 Meowapps 1 Media Usage 2025-05-05 6.1 Medium
The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.4.
CVE-2021-34649 1 Simple-behace-portfolio Project 1 Simple-behace-portfolio 2025-05-05 6.1 Medium
The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2.
CVE-2021-34653 1 Wp Fountain Project 1 Wp Fountain 2025-05-05 6.1 Medium
The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9.
CVE-2021-34654 1 Custom Post Type Relations Project 1 Custom Post Type Relations 2025-05-05 6.1 Medium
The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVE-2021-34651 1 Scribblemaps 1 Scribble Maps 2025-05-05 6.1 Medium
The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
CVE-2021-34656 1 Videowhisper 1 2way Videocalls And Random Chat 2025-05-05 6.1 Medium
The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7.
CVE-2021-34657 1 Typofr Project 1 Typofr 2025-05-05 6.1 Medium
The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.11.
CVE-2021-34666 1 Add Sidebar Project 1 Add Sidebar 2025-05-05 6.1 Medium
The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.0.
CVE-2021-34667 1 Calendar Plugin Project 1 Calendar Plugin 2025-05-05 6.1 Medium
The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calendar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVE-2021-34641 1 Seopress 1 Seopress 2025-05-05 6.4 Medium
The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.
CVE-2022-43046 1 Oretnom23 1 Food Ordering Management System 2025-05-05 4.8 Medium
Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php.
CVE-2021-38315 1 Smartypantsplugins 1 Sp Project \& Document Manager 2025-05-05 6.1 Medium
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.