product: Popular Posts by Webline

vendor: WeblineIndia

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Popular Posts by Webline popular-posts-by-webline allows Stored XSS.This issue affects Popular Posts by Webline: from n/a through <= 1.1.1.

title: Weblineindia Popular Posts By Webline security vulnerability


default_status: unaffected

product: WP Microdata

vendor: tormorten

status: affected

version_type: custom

ecosystem: software/application

metric_type: Secondary

severity: medium

quality: metadata-backed

recipe_kind: composed

status: Deferred

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten WP Microdata wp-microdata allows Stored XSS.This issue affects WP Microdata: from n/a through <= 1.0.

title: Tormorten Wp Microdata security vulnerability


product: WP Popup Builder

vendor: ThemeHunk

status: unaffected

part: a

vendor: themehunk

status: Modified

summary: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through <= 1.3.8.

title: Themehunk Wp Popup Builder security vulnerability


product: WPC Smart Messages for WooCommerce

vendor: WPClever

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Smart Messages for WooCommerce wpc-smart-messages allows Stored XSS.This issue affects WPC Smart Messages for WooCommerce: from n/a through <= 4.2.8.

title: Wpclever Wpc Smart Messages For Woocommerce security vulnerability


product: WP Geo

vendor: Ben Huson

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ben Huson WP Geo wp-geo allows Stored XSS.This issue affects WP Geo: from n/a through <= 3.5.1.

title: Ben Huson Wp Geo security vulnerability


product: Query Posts

vendor: Justin Tadlock

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Query Posts query-posts allows Stored XSS.This issue affects Query Posts: from n/a through <= 0.3.2.

title: Justin Tadlock Query Posts security vulnerability


product: Referral Link Tracker

summary: Missing Authorization vulnerability in epiphanyit321 Referral Link Tracker referral-link-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Referral Link Tracker: from n/a through <= 1.1.4.

title: Epiphanyit321 Referral Link Tracker security vulnerability


product: Custom Post Type Attachment

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Custom Post Type Attachment custom-post-type-pdf-attachment allows Stored XSS.This issue affects Custom Post Type Attachment: from n/a through <= 3.4.6.

title: Aviplugins.Com Custom Post Type Attachment security vulnerability


product: Smart WeTransfer

vendor: mrityunjay

summary: Missing Authorization vulnerability in mrityunjay Smart WeTransfer smart-wetransfer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WeTransfer: from n/a through <= 1.3.

title: Mrityunjay Smart Wetransfer security vulnerability


product: Video Gallery by Huzzaz

vendor: deshine

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS.This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5.

title: Deshine Video Gallery By Huzzaz security vulnerability


product: Rock Convert

vendor: Rock Content

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Content Rock Convert rock-convert allows Stored XSS.This issue affects Rock Convert: from n/a through <= 3.0.1.

title: Rock Content Rock Convert security vulnerability


product: SiteGround Email Marketing

vendor: SiteGround

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.1.

title: Siteground Siteground Email Marketing security vulnerability


product: Opal Service

vendor: wpopal

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Service opal-service allows Stored XSS.This issue affects Opal Service: from n/a through <= 1.9.1.

title: Wpopal Opal Service security vulnerability


product: Effect Maker

vendor: anibalwainstein

summary: Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Effect Maker: from n/a through <= 1.2.1.

title: Anibalwainstein Effect Maker security vulnerability


vendor: clicksend

summary: Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through <= 1.4.0.

title: Clicksend Sms Contact Form 7 Notifications By Clicksend security vulnerability


product: Flights & Hotels Booking WP Plugin

vendor: Travon WP

summary: Missing Authorization vulnerability in Travon WP Flights & Hotels Booking WP Plugin adiaha-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flights & Hotels Booking WP Plugin: from n/a through <= 3.1.

title: Travon Wp Flights & Hotels Booking Wp Plugin security vulnerability


product: Tooltipy

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.9.

title: Jamel.Z Tooltipy security vulnerability


product: IgnitionDeck

vendor: ignitionwp

summary: Missing Authorization vulnerability in ignitionwp IgnitionDeck ignitiondeck allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IgnitionDeck: from n/a through <= 2.0.15.

title: Ignitionwp Ignitiondeck security vulnerability


product: TS Demo Importer

vendor: themeshopy

summary: Missing Authorization vulnerability in themeshopy TS Demo Importer ts-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Demo Importer: from n/a through <= 0.1.3.

title: Themeshopy Ts Demo Importer security vulnerability


product: USERCENTRICS CMP

vendor: webnique

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webnique USERCENTRICS CMP usercentrics-consent-management-platform allows Stored XSS.This issue affects USERCENTRICS CMP: from n/a through <= 1.0.9.

title: Webnique Usercentrics Cmp security vulnerability


product: Bulk Auto Image Title Attribute

vendor: Pagup

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Bulk Auto Image Title Attribute bulk-image-title-attribute allows DOM-Based XSS.This issue affects Bulk Auto Image Title Attribute: from n/a through <= 2.0.1.

title: Pagup Bulk Auto Image Title Attribute security vulnerability


product: Export Categories

vendor: Shambhu Patnaik

summary: Missing Authorization vulnerability in Shambhu Patnaik Export Categories export-categories allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export Categories: from n/a through <= 1.0.

title: Shambhu Patnaik Export Categories security vulnerability


product: Marquee Addons for Elementor

vendor: Debuggers Studio

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio Marquee Addons for Elementor marquee-addons-for-elementor allows DOM-Based XSS.This issue affects Marquee Addons for Elementor: from n/a through <= 3.8.2.

title: Debuggers Studio Marquee Addons For Elementor security vulnerability


product: Post Grid and Gutenberg Blocks

vendor: PickPlugins

summary: Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.

title: Pickplugins Post Grid And Gutenberg Blocks security vulnerability


vendor: Conversios

summary: Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.13.

title: Conversios Conversios.Io security vulnerability


product: TempTool [Show Current Template Info]

vendor: HappyDevs

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-name allows Stored XSS.This issue affects TempTool [Show Current Template Info]: from n/a through <= 1.3.1.

title: Happydevs Temptool [Show Current Template Info] security vulnerability


product: Nelio Content

vendor: Nelio Software

summary: Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Content: from n/a through <= 4.0.5.

title: Nelio Software Nelio Content security vulnerability


product: SEO Meta Description Updater

vendor: Joby Joseph

summary: Missing Authorization vulnerability in Joby Joseph SEO Meta Description Updater seo-meta-description-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Meta Description Updater: from n/a through <= 1.2.0.

title: Joby Joseph Seo Meta Description Updater security vulnerability


product: Testimonial Slider

summary: Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.

title: Pickplugins Testimonial Slider security vulnerability


product: MapSVG

vendor: RomanCode

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.7.22.

title: Romancode Mapsvg security vulnerability


product: MSN Partner Hub

vendor: microsoftstart

ecosystem: windows/system

summary: Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSN Partner Hub: from n/a through <= 2.9.

title: Microsoftstart Msn Partner Hub security vulnerability


product: Table Block by RioVizual

vendor: wprio

summary: Missing Authorization vulnerability in wprio Table Block by RioVizual riovizual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by RioVizual: from n/a through <= 3.0.0.

title: Wprio Table Block By Riovizual security vulnerability


product: Awesome Testimonials

vendor: Prakash

severity: high

summary: Cross-Site Request Forgery (CSRF) vulnerability in Prakash Awesome Testimonials awesome-testimonials allows Stored XSS.This issue affects Awesome Testimonials: from n/a through <= 2.2.1.

title: Prakash Awesome Testimonials security vulnerability


product: WP Business Hours

vendor: Mejar

summary: Cross-Site Request Forgery (CSRF) vulnerability in Mejar WP Business Hours wp-business-hours allows Stored XSS.This issue affects WP Business Hours: from n/a through <= 1.4.

title: Mejar Wp Business Hours security vulnerability


product: Open Close WooCommerce Store

vendor: StackWC

summary: Missing Authorization vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 5.0.0.

title: Stackwc Open Close Woocommerce Store security vulnerability


product: xSmart

vendor: Jthemes

summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through <= 1.2.9.4.

title: Jthemes Xsmart security vulnerability


product: Post List Featured Image

vendor: Johnny

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johnny Post List Featured Image post-list-featured-image allows Stored XSS.This issue affects Post List Featured Image: from n/a through <= 0.5.9.

title: Johnny Post List Featured Image security vulnerability


product: Reoon Email Verifier

vendor: Reoon Technology

summary: Missing Authorization vulnerability in Reoon Technology Reoon Email Verifier reoon-email-verifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reoon Email Verifier: from n/a through <= 2.0.1.

title: Reoon Technology Reoon Email Verifier security vulnerability


product: Open Currency Converter

vendor: Joe

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Open Currency Converter artiss-currency-converter allows Stored XSS.This issue affects Open Currency Converter: from n/a through <= 1.5.0.

title: Joe Open Currency Converter security vulnerability


product: Blox Lite

vendor: Nick Diego

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Diego Blox Lite blox-lite allows Stored XSS.This issue affects Blox Lite: from n/a through <= 1.2.8.

title: Nick Diego Blox Lite security vulnerability


product: Events Maker by dFactory

vendor: dFactory

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Events Maker by dFactory events-maker allows Stored XSS.This issue affects Events Maker by dFactory: from n/a through <= 1.6.14.

title: Dfactory Events Maker By Dfactory security vulnerability


product: WP Mapbox GL JS Maps

vendor: tempranova

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tempranova WP Mapbox GL JS Maps wp-mapbox-gl-js allows Stored XSS.This issue affects WP Mapbox GL JS Maps: from n/a through <= 3.0.1.

title: Tempranova Wp Mapbox Gl Js Maps security vulnerability


product: Next Page, Not Next Post

vendor: Matt McInvale

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt McInvale Next Page, Not Next Post next-page-not-next-post allows Stored XSS.This issue affects Next Page, Not Next Post: from n/a through <= 0.3.0.

title: Matt Mcinvale Next Page, Not Next Post security vulnerability


product: MSTW CSV EXPORTER

vendor: Mark O'Donnell

summary: Missing Authorization vulnerability in Mark O'Donnell MSTW CSV EXPORTER mstw-csv-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSTW CSV EXPORTER: from n/a through <= 1.4.

title: Mark O'Donnell Mstw Csv Exporter security vulnerability


product: Did Prestashop Display

vendor: Eduard Pinuaga Linares

summary: Cross-Site Request Forgery (CSRF) vulnerability in Eduard Pinuaga Linares Did Prestashop Display did-prestashop-display allows Stored XSS.This issue affects Did Prestashop Display: from n/a through <= 1.0.30.

title: Eduard Pinuaga Linares Did Prestashop Display security vulnerability


product: Everest Backup

vendor: everestthemes

summary: Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.

title: Everestthemes Everest Backup security vulnerability


product: Publitio

vendor: publitio

summary: Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publitio: from n/a through <= 2.2.5.

title: Publitio security vulnerability


product: Date counter

vendor: Konstantin Pankratov

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Konstantin Pankratov Date counter date-counter allows Stored XSS.This issue affects Date counter: from n/a through <= 2.0.3.

title: Konstantin Pankratov Date Counter security vulnerability


product: Activity Plus Reloaded for BuddyPress

vendor: BuddyDev

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.

title: Buddydev Activity Plus Reloaded For Buddypress security vulnerability


product: Contest Gallery

summary: Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.0.0.

title: Wasiliy Strecker / Contestgallery Developer Contest Gallery security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz H5P h5p allows Stored XSS.This issue affects H5P: from n/a through <= 1.16.0.

title: Icc0Rz H5P security vulnerability


product: ChatBot

vendor: QuantumCloud

summary: Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.7.3.

title: Quantumcloud Chatbot security vulnerability


product: Welcart e-Commerce

summary: Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24.

title: Info@Welcart Welcart E-Commerce security vulnerability


product: Revive Old Posts

vendor: rsocial

summary: Missing Authorization vulnerability in rsocial Revive Old Posts tweet-old-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive Old Posts: from n/a through <= 9.3.3.

title: Rsocial Revive Old Posts security vulnerability


product: TempTool [Show Current Template Info]

vendor: HappyDevs

summary: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-name allows Retrieve Embedded Sensitive Data.This issue affects TempTool [Show Current Template Info]: from n/a through <= 1.3.1.

title: Happydevs Temptool [Show Current Template Info] security vulnerability


product: Reloadly

vendor: iseremet

summary: Cross-Site Request Forgery (CSRF) vulnerability in iseremet Reloadly reloadly-topup-widget allows Stored XSS.This issue affects Reloadly: from n/a through <= 2.0.1.

title: Iseremet Reloadly security vulnerability


product: NikanWP WooCommerce Reporting

vendor: NikanWP

summary: Cross-Site Request Forgery (CSRF) vulnerability in NikanWP NikanWP WooCommerce Reporting wc-reports-lite allows Stored XSS.This issue affects NikanWP WooCommerce Reporting: from n/a through <= 1.0.0.

title: Nikanwp Nikanwp Woocommerce Reporting security vulnerability


vendor: Clifton Griffin

summary: Cross-Site Request Forgery (CSRF) vulnerability in Clifton Griffin Simple Content Templates for Blog Posts & Pages simple-post-template allows Cross Site Request Forgery.This issue affects Simple Content Templates for Blog Posts & Pages: from n/a through <= 2.2.61.

title: Clifton Griffin Simple Content Templates For Blog Posts & Pages security vulnerability


product: Paid Videochat Turnkey Site

vendor: videowhisper

severity: critical

summary: Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusion.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.23.

title: Videowhisper Paid Videochat Turnkey Site security vulnerability


product: Construction Light

vendor: sparklewpthemes

summary: Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Light: from n/a through <= 1.6.7.

title: Sparklewpthemes Construction Light security vulnerability


product: Sparkle FSE

summary: Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sparkle FSE: from n/a through <= 1.0.9.

title: Sparklewpthemes Sparkle Fse security vulnerability


product: CloudSearch

vendor: Andrea Landonio

summary: Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS.This issue affects CloudSearch: from n/a through <= 3.0.0.

title: Andrea Landonio Cloudsearch security vulnerability


product: Estatik

vendor: Estatik

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.3.1.

title: Estatik security vulnerability


product: MDTF

summary: Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.6.

title: Realmag777 Mdtf security vulnerability


product: Admin Management Xtended

vendor: wpseek

summary: Missing Authorization vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin Management Xtended : from n/a through <= 2.5.1.

title: Wpseek Admin Management Xtended security vulnerability


product: GoCache

vendor: Apiki

summary: Missing Authorization vulnerability in Apiki GoCache gocache-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoCache: from n/a through <= 1.3.6.

title: Apiki Gocache security vulnerability


product: DirectoryPress

vendor: Designinvento

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows DOM-Based XSS.This issue affects DirectoryPress: from n/a through <= 3.6.25.

title: Designinvento Directorypress security vulnerability


product: WP Last Modified Info

vendor: Sayan Datta

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Stored XSS.This issue affects WP Last Modified Info: from n/a through <= 1.9.2.

title: Sayan Datta Wp Last Modified Info security vulnerability


product: NextMove Lite

vendor: XLPlugins

product: nextmove

vendor: xlplugins

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Stored XSS.This issue affects NextMove Lite: from n/a through <= 2.23.0.

title: Xlplugins Nextmove security vulnerability


product: Link Whisper Free

vendor: Spencer Haws

summary: Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2.

title: Spencer Haws Link Whisper Free security vulnerability


product: Attesa Extra

vendor: CrestaProject

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrestaProject Attesa Extra attesa-extra allows Stored XSS.This issue affects Attesa Extra: from n/a through <= 1.4.7.

title: Crestaproject Attesa Extra security vulnerability


product: WebinarPress

vendor: WPWebinarSystem

product: webinarpress

vendor: webinarpress

summary: Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.

title: Webinarpress security vulnerability


product: BuddyForms

vendor: Themekraft

product: buddyforms

vendor: themekraft

summary: Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through <= 2.9.0.

title: Themekraft Buddyforms security vulnerability


product: Headline Analyzer

vendor: CoSchedule

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Stored XSS.This issue affects Headline Analyzer: from n/a through <= 1.3.7.

title: Coschedule Headline Analyzer security vulnerability


product: Raychat

vendor: raychat

summary: Cross-Site Request Forgery (CSRF) vulnerability in raychat Raychat raychat allows Cross Site Request Forgery.This issue affects Raychat: from n/a through <= 2.2.1.

title: Raychat security vulnerability


product: Sendle Shipping

vendor: Joovii

summary: Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sendle Shipping: from n/a through <= 6.02.

title: Joovii Sendle Shipping security vulnerability


product: SEO ( / /Bing/ )

summary: Missing Authorization vulnerability in SEO ( / /Bing/ ) baiduseo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SEO ( / /Bing/ ): from n/a through <= 2.1.4.

title: Seo ( / /Bing/ ) security vulnerability


product: KiotViet Sync

vendor: Kiotviet

summary: Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.

title: Kiotviet Kiotviet Sync security vulnerability


product: ACF to REST API

vendor: airesvsg

summary: Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue affects ACF to REST API: from n/a through <= 3.3.4.

title: Airesvsg Acf To Rest Api security vulnerability


product: Persian Admnin Fonts

vendor: MDZ

summary: Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Persian Admnin Fonts: from n/a through <= 4.1.03.

title: Mdz Persian Admnin Fonts security vulnerability


product: WP Gravity Forms Zoho CRM and Bigin

vendor: CRM Perks

summary: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8.

title: Crm Perks Wp Gravity Forms Zoho Crm And Bigin security vulnerability


product: Dynamic User Directory

vendor: Sarah Giles

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through <= 2.3.

title: Sarah Giles Dynamic User Directory security vulnerability


product: Posts By Tag

vendor: Sudar Muthu

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu Posts By Tag posts-by-tag allows Stored XSS.This issue affects Posts By Tag: from n/a through <= 3.2.1.

title: Sudar Muthu Posts By Tag security vulnerability


product: WP AdCenter

vendor: WPeka

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.6.1.

title: Wpeka Wp Adcenter security vulnerability


product: Simple Pull Quote

vendor: llamaman

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in llamaman Simple Pull Quote simple-pull-quote allows Stored XSS.This issue affects Simple Pull Quote: from n/a through <= 1.6.3.

title: Llamaman Simple Pull Quote security vulnerability


product: FanBridge signup

vendor: FanBridge

summary: Cross-Site Request Forgery (CSRF) vulnerability in FanBridge FanBridge signup fanbridge-signup allows Stored XSS.This issue affects FanBridge signup: from n/a through <= 0.6.

title: Fanbridge Fanbridge Signup security vulnerability


product: Builderall Builder for WordPress

vendor: Builderall

ecosystem: php/wordpress

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Stored XSS.This issue affects Builderall Builder for WordPress: from n/a through <= 3.0.1.

title: Builderall Builderall Builder For Wordpress security vulnerability


product: Slider Templates

vendor: Codeless

archetype: ssrf

summary: Server-Side Request Forgery (SSRF) vulnerability in Codeless Slider Templates slider-templates allows Server Side Request Forgery.This issue affects Slider Templates: from n/a through <= 1.0.3.

title: Codeless Slider Templates security vulnerability


product: Cooked

vendor: Gora Tech

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.

title: Gora Tech Cooked security vulnerability


product: Livemesh Addons for Beaver Builder

vendor: livemesh

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Beaver Builder addons-for-beaver-builder allows Stored XSS.This issue affects Livemesh Addons for Beaver Builder: from n/a through <= 3.9.2.

title: Livemesh Livemesh Addons For Beaver Builder security vulnerability


product: Minamaze

vendor: thinkupthemes

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Minamaze minamaze allows Stored XSS.This issue affects Minamaze: from n/a through <= 1.10.1.

title: Thinkupthemes Minamaze security vulnerability


product: Everest Backup

vendor: everestthemes

metric_type: Primary

summary: Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Path Traversal.This issue affects Everest Backup: from n/a through <= 2.3.11.

title: Everestthemes Everest Backup security vulnerability


product: Notification for Telegram

vendor: rainafarai

summary: Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through <= 3.5.1.

title: Rainafarai Notification For Telegram security vulnerability


product: WP AI CoPilot

vendor: WP Messiah

summary: Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.

title: Wp Messiah Wp Ai Copilot security vulnerability


product: MultiParcels Shipping For WooCommerce

vendor: multiparcels

summary: Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through <= 1.30.12.

title: Multiparcels Multiparcels Shipping For Woocommerce security vulnerability


vendor: Code Amp

summary: Missing Authorization vulnerability in Code Amp Custom Layouts – Post + Product grids made easy custom-layouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Layouts – Post + Product grids made easy: from n/a through <= 1.4.12.

title: Code Amp Custom Layouts – Post + Product Grids Made Easy security vulnerability


product: WP EasyCart

vendor: levelfourdevelopment

summary: Insertion of Sensitive Information Into Sent Data vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Retrieve Embedded Sensitive Data.This issue affects WP EasyCart: from n/a through <= 5.8.11.

title: Levelfourdevelopment Wp Easycart security vulnerability


product: Litho Addons

vendor: themezaa

summary: Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through <= 3.5.

title: Themezaa Litho Addons security vulnerability