sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total16,358
Critical1,021
High3,397
Medium11,667
Reset
Showing 14521-14540 of 16358 records
Threat Entry Updated 2024-11-21

CVE-2022-2171 - Progressive License Plugin

The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.

PLUGIN Progressive License

CVE-2022-2171

MEDIUM CVSS 5.4 2022-08-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2215 - Before 2 Plugin

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Before 2

CVE-2022-2215

MEDIUM CVSS 4.8 2022-08-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2170 - Before 1 Plugin

The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.

PLUGIN Before 1

CVE-2022-2170

MEDIUM CVSS 4.8 2022-08-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-1585 - Project Source Code Download Plugin

The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.

PLUGIN Project Source Code Download

CVE-2022-1585

HIGH CVSS 7.5 2022-08-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-1906 - Copyright Proof Plugin

The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.

PLUGIN Copyright Proof

CVE-2022-1906

MEDIUM CVSS 6.1 2022-08-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-1600 - Yop Poll Plugin

The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.

PLUGIN Yop Poll

CVE-2022-1600

MEDIUM CVSS 5.3 2022-08-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-1324 - Event Timeline Plugin

The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

PLUGIN Event Timeline

CVE-2022-1324

MEDIUM CVSS 4.8 2022-08-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-0598 - Before 1 Plugin

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PLUGIN Before 1

CVE-2022-0598

MEDIUM CVSS 4.8 2022-08-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-33994 - Gutenberg Plugin

The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.

PLUGIN Gutenberg

CVE-2022-33994

LOW CVSS 3.0 2022-07-30
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2240 - Request A Quote Plugin

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

PLUGIN Request A Quote

CVE-2022-2240

HIGH CVSS 8.8 2022-07-25
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-1539 - Exports And Reports Plugin

The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.

PLUGIN Exports And Reports

CVE-2022-1539

HIGH CVSS 8.8 2022-07-25
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-2219 - Before 2 Plugin

The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

PLUGIN Before 2

CVE-2022-2219

HIGH CVSS 7.2 2022-07-25
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2022-1551 - Document Manager Plugin

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.

PLUGIN Document Manager

CVE-2022-1551

MEDIUM CVSS 6.5 2022-07-25
Open Full Technical Breakdown
Scroll to top