Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2022-0701 - Seo 301 Meta Plugin
The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Seo 301 Meta
CVE-2022-0701
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0700 - Simple Tracking Plugin
The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Simple Tracking
CVE-2022-0700
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0684 - Wp Home Page Menu Plugin
The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Wp Home Page Menu
CVE-2022-0684
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0674 - Before 2 Plugin
The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Before 2
CVE-2022-0674
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0659 - Sync Qcloud Cos Plugin
The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Sync Qcloud Cos
CVE-2022-0659
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0254 - Wordpress Zero Spam Plugin
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
PLUGIN
Wordpress Zero Spam
CVE-2022-0254
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0169 - Photo Gallery By 10web Plugin
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
PLUGIN
Photo Gallery By 10web
CVE-2022-0169
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25007 - Molie Instructure Canvas Linking Tool Plugin
The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection
PLUGIN
Molie Instructure Canvas Linking Tool
CVE-2021-25007
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0478 - Event Manager And Tickets Selling For Woocommerce Plugin
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
PLUGIN
Event Manager And Tickets Selling For Woocommerce
CVE-2022-0478
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0449 - Before 4 Plugin
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 4
CVE-2022-0449
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0399 - Advanced Product Labels For Woocommerce Plugin
The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting
PLUGIN
Advanced Product Labels For Woocommerce
CVE-2022-0399
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0327 - Master Addons For Elementor Plugin
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting
PLUGIN
Master Addons For Elementor
CVE-2022-0327
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0321 - Wp Voting Contest Plugin
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
PLUGIN
Wp Voting Contest
CVE-2022-0321
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0248 - Contact Form Submissions Plugin
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
PLUGIN
Contact Form Submissions
CVE-2022-0248
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0230 - Bwp Google Xml Sitemaps Plugin
The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
PLUGIN
Bwp Google Xml Sitemaps
CVE-2022-0230
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0165 - Kingcomposer Plugin
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
PLUGIN
Kingcomposer
CVE-2022-0165
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0161 - Ari Fancy Lightbox Plugin
The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
PLUGIN
Ari Fancy Lightbox
CVE-2022-0161
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0147 - Free Gdpr Consent Solution Plugin
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Free Gdpr Consent Solution
CVE-2022-0147
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25006 - Molie Instructure Canvas Linking Tool Plugin
The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Molie Instructure Canvas Linking Tool
CVE-2021-25006
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25026 - Before 1 Plugin
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Before 1
CVE-2021-25026
Risk Score