Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2023-25989

Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks

Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq
Products
Meks Audio Player Meks Easy Ads Widget Meks Easy Maps and 7 more
CVE-2025-9206

Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the map containing the malicious post.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq Wordpress
Products
Meks Easy Maps Wordpress
CVE-2024-6599

Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification

The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API keys. CVE-2024-38733 may be a duplicate of this issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq Wordpress
Products
Meks Video Importer Wordpress
CVE-2024-0664

Meks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting

The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meks Smart Social Widget in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq
Products
Meks Smart Social Widget
CVE-2022-2574

Meks Easy Social Share < 1.2.8 - Admin+ Stored Cross-Site Scripting

The Meks Easy Social Share WordPress plugin before 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq
Products
Meks Easy Social Share
CVE-2022-4562

Meks Flexible Shortcodes < 1.3.5 - Contributor+ Stored XSS

The Meks Flexible Shortcodes WordPress plugin before 1.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq
Products
Meks Flexible Shortcodes
CVE-2024-37958

WordPress Meks Smart Author Widget plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Meks Meks Smart Author Widget allows Stored XSS.This issue affects Meks Smart Author Widget: from n/a through 1.1.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq
Products
Meks Smart Author Widget
CVE-2024-37548

WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq
Products
Meks Easy Ads Widget
CVE-2021-24958

Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site Scripting payloads in them

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mekshq
Products
Meks Easy Photo Feed Widget