CVE Catalog

A stored cross-site scripting vulnerability has been identified in the WordPress plugin Incredible Font Awesome, affecting versions through 1.0. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the TC Ajax WP Query Search Filter plugin for WordPress, affecting versions through 1.0.7. This vulnerability arises from improper input sanitization during web page generation, allowing malicious actors to inject scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Feedburner Optin Form plugin, affecting versions through 0.2.8. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WP Photo Sphere WordPress plugin, affecting versions through 3.8. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress iSpring Embedder plugin, specifically in versions through 1.0. This vulnerability allows attackers to upload a web shell to a web server by exploiting the CSRF flaw.

A cross-site scripting (XSS) vulnerability allowing code injection has been identified in the WordPress Slides & Presentations plugin, versions through 0.0.39. This vulnerability arises from improper neutralization of script-related HTML tags, which could enable a malicious actor to inject content into pages and posts, potentially including phishing materials.

A broken access control vulnerability has been identified in the Chamber Dashboard Business Directory WordPress plugin, affecting versions through 3.3.10. This vulnerability arises from missing authorization checks, which could allow an unprivileged user to perform actions reserved for higher privileged users.

A missing authorization vulnerability exists in the Nuanced Media WP Meetup plugin, affecting versions through 2.3.0. This vulnerability allows for exploitation of improperly configured access control security levels, potentially leading to unauthorized changes in settings.

A local file inclusion vulnerability has been identified in the Roninwp FAT Event Lite WordPress plugin, affecting versions through 1.1. This vulnerability arises from improper control of filenames in include or require statements, allowing for PHP remote file inclusion. Exploitation of this issue could enable a malicious actor to include local files from the target website and display their contents, potentially leading to a database takeover if sensitive information such as database credentials is accessed.

A SQL injection vulnerability has been identified in the WordPress Google Map Professional plugin, affecting versions through 1.0. This vulnerability allows for improper neutralization of special elements used in SQL commands, potentially enabling attackers to manipulate database queries and interact directly with the database.

A blind SQL injection vulnerability has been identified in the Typomedia Foundation WordPress Custom Sidebar plugin, affecting versions through 2.3. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing for unauthorized database manipulation.

A SQL injection vulnerability has been identified in the Solidres – Hotel Booking plugin for WordPress, affecting versions through 0.9.4. This vulnerability allows for improper neutralization of special elements used in SQL commands, potentially enabling attackers to manipulate database queries and interact directly with the database.

A stored cross-site scripting vulnerability has been identified in the Common Ninja Compare Ninja plugin for WordPress, affecting versions through 2.1.0. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Pastebin Plugin, affecting versions through 1.5. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Social Ninja plugin, specifically in versions through 0.2. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject harmful scripts that are executed when users visit the affected site.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress Error Notification plugin, specifically in versions through 0.2.7. This vulnerability allows attackers to trick users with higher privileges into performing actions they did not intend to.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Oliver Schaal GravatarLocalCache WordPress plugin, affecting versions through 1.1.2. This vulnerability allows attackers to trick users with higher privileges into performing actions they did not intend to.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Genkisan Genki Announcement WordPress plugin, affecting versions through 1.4.1. This vulnerability allows attackers to trick users with higher privileges into performing actions they did not intend to.

A stored cross-site scripting vulnerability has been identified in the BnB Select Ltd Bookalet WordPress plugin, affecting versions through 1.0.3. This vulnerability arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Apply with LinkedIn Buttons plugin, specifically in versions through 2.3. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks. The issue arises because the plugin does not properly validate requests, enabling attackers to trick users with higher privileges into performing actions that could inject malicious scripts.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress Apply with LinkedIn buttons plugin, affecting versions through 2.3. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject and execute harmful scripts on the site.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress Mindmeister Shortcode plugin, affecting versions through 1.0. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject and execute harmful scripts on the site.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Add RSS plugin, specifically in versions through 1.5. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks. The issue arises from the plugin's failure to properly validate requests, enabling attackers to trick users with higher privileges into performing actions that could inject malicious scripts into the site.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress GMap Shortcode plugin, affecting versions through 2.0. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject and execute harmful scripts on the site.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress Progress Tracker plugin, affecting versions through 0.9.3. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject and execute harmful scripts or HTML payloads on the affected site.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress Yet Another Countdown plugin, affecting versions through 1.0.1. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject and execute harmful scripts on the site.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress Easy Tweet Embed plugin, affecting versions through 1.7. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject and execute harmful scripts on the site.

A stored cross-site scripting vulnerability has been identified in the WordPress Blog Summary plugin, specifically in versions through 0.1.2 β. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Annie plugin, affecting versions through 2.1.1. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress Annie plugin, affecting versions through 2.1.1. This vulnerability allows attackers to trick users with higher privileges into performing actions they did not intend to.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress amr personalise plugin, affecting versions through 2.10. This vulnerability allows attackers to trick users with higher privileges into performing actions they did not intend to.

A stored cross-site scripting vulnerability has been identified in the WordPress Post-to-Post Links plugin, affecting versions through 4.2. This issue arises from improper input sanitization during web page generation, allowing malicious users to inject scripts that are executed when other users visit the affected page.

A stored cross-site scripting vulnerability has been identified in the Nite Shortcodes WordPress plugin, affecting versions through 1.0. This issue arises from improper input sanitization during web page generation, allowing malicious actors to inject scripts that are executed when users visit the site.

A stored cross-site scripting vulnerability has been identified in the WordPress WP krpano plugin, affecting versions through 1.2.1. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Better Protected Pages plugin, affecting versions through 1.0. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks. The issue arises because the plugin does not properly validate requests, enabling attackers to trick users with higher privileges into performing actions that could lead to XSS vulnerabilities.

A stored cross-site scripting vulnerability has been identified in the Anshi Solutions Category D3 Tree plugin for WordPress, affecting versions through 1.1. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the PayForm WordPress plugin, affecting versions through 2.0. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks, where a malicious actor could trick users with higher privileges into performing actions that could lead to the execution of harmful scripts.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the LSD Google Maps Embedder WordPress plugin, affecting versions through 1.1. This vulnerability allows attackers to trick users with higher privileges into performing actions they did not intend to.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Copyright Safeguard Footer Notice plugin, affecting versions through 3.0. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks. The issue arises because the plugin does not properly validate requests, enabling attackers to trick users with higher privileges into performing actions that could lead to XSS vulnerabilities.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress CJ Custom Content plugin, specifically in versions through 2.0. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks. The issue arises because the plugin does not properly validate requests, enabling attackers to trick users with higher privileges into performing actions that could introduce malicious scripts that are stored and executed later.

A stored cross-site scripting vulnerability has been identified in the WordPress Chess Tempo Viewer plugin, affecting versions through 0.9.5. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Winning Portfolio plugin, affecting versions through 1.1. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WP Code Snippets WCS QR Code Generator plugin, affecting versions through 1.0. This vulnerability allows for the injection of malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Rollover Tab plugin, affecting versions through 1.3.2. This issue arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A broken access control vulnerability has been identified in the WordPress Contact Form 7 Anti Spambot plugin, affecting versions through 1.0.1. This vulnerability arises from missing authorization checks, which can be exploited by users to perform actions that require higher privileges.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Katz Web Services Debt Calculator WordPress plugin, specifically in versions through 1.0.1. This vulnerability allows attackers to trick users with higher privileges into performing actions they did not intend to.

A stored cross-site scripting vulnerability has been identified in the Eyouth Charity-Thermometer WordPress plugin, affecting versions through 1.1.2. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Daily Proverb plugin, affecting versions through 2.0.3. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A DOM-based cross-site scripting vulnerability has been identified in the WordPress Simple Vertical Timeline plugin, affecting versions through 0.1. This issue arises from improper input neutralization during web page generation, allowing malicious actors to inject and execute harmful scripts on the site.

A stored cross-site scripting vulnerability has been identified in the Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com, affecting versions through 3.3. This vulnerability allows for improper neutralization of input during web page generation, enabling the injection of malicious scripts that could be executed when users visit the affected site.