Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2022-1469 - Before 1 Plugin
The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
PLUGIN
Before 1
CVE-2022-1469
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1394 - Before 1 Plugin
The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1394
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1611 - Before 1 Plugin
The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF.
PLUGIN
Before 1
CVE-2022-1611
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2022-1589 - Before 1 Plugin
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
PLUGIN
Before 1
CVE-2022-1589
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1583 - Before 1 Plugin
The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.
PLUGIN
Before 1
CVE-2022-1583
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1582 - Before 1 Plugin
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
PLUGIN
Before 1
CVE-2022-1582
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1528 - Before 1 Plugin
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 1
CVE-2022-1528
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1562 - Before 1 Plugin
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
PLUGIN
Before 1
CVE-2022-1562
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1566 - Before 1 Plugin
The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file
PLUGIN
Before 1
CVE-2022-1566
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1564 - Before 1 Plugin
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1564
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1203 - Before 1 Plugin
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
PLUGIN
Before 1
CVE-2022-1203
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0642 - Before 1 Plugin
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
PLUGIN
Before 1
CVE-2022-0642
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1547 - Before 1 Plugin
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 1
CVE-2022-1547
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1320 - Before 1 Plugin
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1320
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1409 - Before 1 Plugin
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code
PLUGIN
Before 1
CVE-2022-1409
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1407 - Before 1 Plugin
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack
PLUGIN
Before 1
CVE-2022-1407
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1455 - Before 1 Plugin
The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled
PLUGIN
Before 1
CVE-2022-1455
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1408 - Before 1 Plugin
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1408
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1334 - Before 1 Plugin
The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1334
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1089 - Before 1 Plugin
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Before 1
CVE-2022-1089
Risk Score