Total
34649 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-6798 | 1 Dyadyalesha | 1 Dl Verification | 2025-06-09 | N/A | N/A |
| The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-13053 | 1 10web | 1 Form Maker | 2025-06-09 | N/A | N/A |
| The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-12874 | 1 Top Comments Project | 1 Top Comments | 2025-06-09 | N/A | N/A |
| The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-12873 | 1 F1logic | 1 Custom Field Manager | 2025-06-09 | N/A | N/A |
| The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | |||||
| CVE-2025-22296 | 1 Hashthemes | 1 Hash Elements | 2025-06-09 | N/A | N/A |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements.This issue affects Hash Elements: from n/a through 1.4.9. | |||||
| CVE-2025-30873 | 1 Wpsoul | 1 Greenshift | 2025-06-09 | N/A | 5.4 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows Stored XSS. This issue affects Greenshift: from n/a through 11.0.2. | |||||
| CVE-2024-0589 | 2 Devolutions, Microsoft | 2 Remote Desktop Manager, Windows | 2025-06-09 | N/A | 5.4 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows allows an attacker with access to a data source to inject a malicious script via a specially crafted input in an entry. | |||||
| CVE-2025-30867 | 1 Searchiq | 1 Searchiq | 2025-06-09 | N/A | 5.4 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ allows Stored XSS. This issue affects SearchIQ: from n/a through 4.7. | |||||
| CVE-2025-5383 | 1 Wanglongcn | 1 Yifang | 2025-06-09 | N/A | 4.8 MEDIUM |
| A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Article Management Module. The manipulation of the argument Default Value leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-31501 | 1 Bestpractical | 1 Request Tracker | 2025-06-09 | N/A | 6.1 MEDIUM |
| Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink. | |||||
| CVE-2025-31500 | 1 Bestpractical | 1 Request Tracker | 2025-06-09 | N/A | 6.1 MEDIUM |
| Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name. | |||||
| CVE-2025-30087 | 1 Bestpractical | 1 Request Tracker | 2025-06-09 | N/A | 6.1 MEDIUM |
| Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL. | |||||
| CVE-2023-7168 | 1 Antonpug | 1 Better Flow Button For Jetpack | 2025-06-09 | N/A | N/A |
| The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-11189 | 1 Reputeinfosystems | 1 Social Share And Social Locker | 2025-06-09 | N/A | N/A |
| The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-45094 | 1 Ibm | 6 Hardware Management Console R10.0, Hardware Management Console R10.0 Firmware, Hardware Management Console R9.3 and 3 more | 2025-06-09 | N/A | 5.4 MEDIUM |
| IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2024-11502 | 1 Wpchurchteam | 1 Planning Center Online Giving | 2025-06-09 | N/A | N/A |
| The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2024-11718 | 1 Couleurcitron | 1 Tarteaucitron-wp | 2025-06-09 | N/A | N/A |
| The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2024-11843 | 1 Projectpanorama | 1 Panorama | 2025-06-09 | N/A | N/A |
| The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-0249 | 1 Hijiriworld | 1 Advanced Schedule Posts | 2025-06-09 | N/A | N/A |
| The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins. | |||||
| CVE-2024-10149 | 1 Cm-wp | 1 Social Slider Widget | 2025-06-09 | N/A | N/A |
| The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||