Export limit exceeded: 425871 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10004 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,004

Export CSV
CVE-2022-1843

MailPress <= 7.2.1 - Arbitrary Settings Update & Log Files Purge via CSRF

The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mailpress Project
Products
Mailpress
CVE-2022-1842

OpenBook Book Data <= 3.5.2 - Arbitrary Settings Update to Stored XSS via CSRF

The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbook Book Data Project
Products
Openbook Book Data
CVE-2022-1832

CaPa Protect <= 0.5.8.2 - Arbitrary Settings Update via CSRF

The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Capa Protect Project
Products
Capa Protect
CVE-2022-1831

WPlite <= 1.3.1 - Arbitrary Settings Update via CSRF

The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wplite Project
Products
Wplite
CVE-2022-1830

Amazon Einzeltitellinks <= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRF

The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon Einzeltitellinks Project
Products
Amazon Einzeltitellinks
CVE-2022-1829

Inline Google Maps <= 5.11 - Arbitrary Settings Update to Stored XSS via CSRF

The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Inline Google Maps Project
Products
Inline Google Maps
CVE-2022-1828

PDF24 Articles To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF

The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pdf24 Articles To Pdf Project
Products
Pdf24 Articles To Pdf
CVE-2022-1827

PDF24 Article To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF

The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pdf24 Articles To Pdf Project
Products
Pdf24 Articles To Pdf
CVE-2022-1826

Cross-Linker <= 3.0.1.9 - Arbitrary Cross-Link Creation via CSRF

The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cross-linker Project
Products
Cross-linker
CVE-2022-1818

Multi-page Toolkit <= 2.6 - Arbitrary Settings Update to Stored XSS via CSRF

The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Multi-page Toolkit Project
Products
Multi-page Toolkit
CVE-2022-1793

Private Files <= 0.40 - Protection Disabling via CSRF

The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Private Files Project
Products
Private Files
CVE-2022-1792

Quick Subscribe <= 1.7.1 - Arbitrary Settings Update via CSRF to Stored XSS

The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Quick Subscribe Project
Products
Quick Subscribe
CVE-2022-1791

One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRF

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
One Click Plugin Updater Project
Products
One Click Plugin Updater
CVE-2022-1790

New User Email Set Up <= 0.5.2 - Arbitrary Settings Update via CSRF

The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
New User Email Set Up Project
Products
New User Email Set Up
CVE-2022-1788

Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Change Uploaded File Permissions Project
Products
Change Uploaded File Permissions
CVE-2022-1787

Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS

The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sideblog Project
Products
Sideblog
CVE-2022-1781

postTabs <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS

The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Posttabs Project
Products
Posttabs
CVE-2022-1780

LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS

The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Latex Project
Products
Latex
CVE-2022-1779

Auto Delete Posts <= 1.3.0 - Arbitrary Settings Update via CSRF

The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Auto Delete Posts Project
Products
Auto Delete Posts
CVE-2022-1765

Hot Linked Image Cacher <= 1.16 - Image upload/cache abuse via CSRF

The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks (due to copyright violations or licensing rules).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hot Linked Image Cacher Project
Products
Hot Linked Image Cacher