Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2024-4014

hCaptcha for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode

The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Plugin
Products
Hcaptcha
CVE-2024-5475

Responsive video embed < 0.5.1 - Contributor+ Stored XSS

The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Lepileppanen Wordpress Plugin
Products
Responsive Video Embed Responsive Video Embed
CVE-2024-8044

infolinks Ad Wrap <= 1.0.2 - Settings Update via CSRF

The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Rubayathasan Wordpress Plugin
Products
Infolinks Ad Wrap Infolinks Ad Wrap
CVE-2024-8043

Vikinghammer Tweet <= 0.2.4 - Stored XSS via CSRF

The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Seanschulte Wordpress Plugin
Products
Vikinghammer Tweet Vikinghammer Tweet
CVE-2024-8051

Special Feed Items <= 1.0.1 - Stored XSS via CSRF

The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Moc Wordpress Plugin
Products
Special Feed Items Special Feed Items