Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2024-9663

CYAN Backup < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings

The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Cyan Backup
CVE-2024-9662

CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings

The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Cyan Backup
CVE-2024-10151

Auto iFrame < 2.0 - Contributor+ XSS via Shortcode

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Auto Iframe
CVE-2024-5151

SULly < 4.3.1 - Admin+ Stored XSS

The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Sully
CVE-2024-5032

SULly < 4.3.1 - Reflected XSS

The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Sully
CVE-2024-5033

SULly < 4.3.1 - Admin+ Stored XSS via CSRF

The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Sully
CVE-2024-5034

SULly < 4.3.1 - Plugin Reset via CSRF

The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Sully
CVE-2023-40560

WordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Schedule Posts Calendar
CVE-2023-40556

WordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Toolstack
Products
Schedule Posts Calendar