sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total16,313
Critical1,021
High3,386
Medium11,660
Reset
Showing 14441-14460 of 16313 records
Threat Entry Updated 2024-11-21

CVE-2022-2411 - Auto More Tag Plugin

The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Auto More Tag

CVE-2022-2411

MEDIUM CVSS 4.8 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2410 - Mtouch Quiz Plugin

The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Mtouch Quiz

CVE-2022-2410

MEDIUM CVSS 4.8 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2409 - Rough Chart Plugin

The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PLUGIN Rough Chart

CVE-2022-2409

MEDIUM CVSS 4.8 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2398 - Wordpress Comments Fields Plugin

The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

PLUGIN Wordpress Comments Fields

CVE-2022-2398

MEDIUM CVSS 4.8 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2395 - Before 1 Plugin

The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PLUGIN Before 1

CVE-2022-2395

MEDIUM CVSS 4.8 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2372 - Before 2 Plugin

The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Before 2

CVE-2022-2372

MEDIUM CVSS 4.8 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2269 - Website File Changes Monitor Plugin

The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection

PLUGIN Website File Changes Monitor

CVE-2022-2269

CRITICAL CVSS 9.8 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2356 - Before 1 Plugin

The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.

PLUGIN Before 1

CVE-2022-2356

HIGH CVSS 8.8 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2367 - Wsm Downloader Plugin

The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation

PLUGIN Wsm Downloader

CVE-2022-2367

HIGH CVSS 7.5 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2357 - Wsm Downloader Plugin

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php.

PLUGIN Wsm Downloader

CVE-2022-2357

HIGH CVSS 7.5 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2025-09-24

CVE-2022-2355 - Easy Username Updater Plugin

The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin

PLUGIN Easy Username Updater

CVE-2022-2355

MEDIUM CVSS 6.5 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-1323 - Discy Plugin

The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.

PLUGIN Discy

CVE-2022-1323

MEDIUM CVSS 6.5 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2371 - Before 2 Plugin

The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.

PLUGIN Before 2

CVE-2022-2371

MEDIUM CVSS 5.4 2022-08-08
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2046 - Directorist Plugin

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

PLUGIN Directorist

CVE-2022-2046

MEDIUM CVSS 4.9 2022-08-08
Open Full Technical Breakdown
Scroll to top