Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 146

Export CSV
CVE-2024-29808

WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_id

The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Photo Gallery
CVE-2024-29809

WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_url

The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Photo Gallery
CVE-2024-10566

Slider by 10Web < 1.2.62 - Contributor+ Stored XSS

The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Slider
CVE-2023-0037

10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

CVSS 3.1 · 9.8 Critical EPSS 3.9% KEV · Not listed
Vendors
10web
Products
Map Builder For Google Maps
CVE-2023-2224

Seo By 10Web < 1.2.7 - Admin+ Stored XSS

The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Seo
CVE-2023-1427

Photo Gallery by 10Web < 1.8.15 - Admin+ Path Traversal

- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Photo Gallery
CVE-2023-2117

Image Optimizer by 10web < 1.0.27 - Admin+ Path Traversal

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
10web
Products
Image Optimizer
CVE-2023-2503

10WebSocial < 1.2.9 - Reflected XSS

The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
10web Social Post Feed
CVE-2024-6026

Slider by 10Web < 1.2.56 - Editor+ Stored XSS

The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access to the Sliders (by default Administrator, however this can be changed via the Slider by 10Web WordPress plugin before 1.2.56's options) and the ability to add images (Editor+) to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Slider
CVE-2024-35628

WordPress Photo Gallery by 10Web plugin <= 1.8.25 - Broken Access Control vulnerability

Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Photo Gallery
CVE-2023-5559

10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.

CVSS 3.1 · 9.1 Critical EPSS 3.0% KEV · Not listed
Vendors
10web
Products
10web Booster
CVE-2023-48290

WordPress Form Maker by 10Web plugin <= 1.15.20 - Captcha Bypass Vulnerability vulnerability

Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Form Maker
CVE-2023-34375

WordPress Seo By 10Web Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web SEO by 10Web plugin <= 1.2.9 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
10web
Products
Seo
CVE-2023-2122

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Image Optimizer
CVE-2022-4058

Photo Gallery < 1.8.3 - Stored XSS via CSRF

The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Photo Gallery
CVE-2022-1564

Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS 1.1% KEV · Not listed
Vendors
10web
Products
Form Maker
CVE-2022-1394

Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site Scripting

The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS 1.1% KEV · Not listed
Vendors
10web
Products
Photo Gallery
CVE-2022-1320

Sliderby10Web < 1.2.52 - Admin+ Stored Cross-Site Scripting

The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS 1.1% KEV · Not listed
Vendors
10web
Products
Sliderby10web
CVE-2022-1282

Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Photo Gallery
CVE-2022-1281

Photo Gallery < 1.6.3 - Unauthenticated SQL Injection

The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.

CVSS 3.1 · 9.8 Critical EPSS 43.4% KEV · Not listed
Vendors
10web
Products
Photo Gallery