Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (44676 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-25055 1 Feedwordpress Project 1 Feedwordpress 2024-11-21 6.1 Medium
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
CVE-2021-25050 1 Wpchill 1 Remove Footer Credit 2024-11-21 4.8 Medium
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVE-2021-25049 1 Mobileeventsmanager 1 Mobile Events Manager 2024-11-21 4.8 Medium
The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2021-25048 1 King-theme 1 Kingcomposer 2024-11-21 5.4 Medium
The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
CVE-2021-25047 1 10web 1 10websocial 2024-11-21 6.1 Medium
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
CVE-2021-25046 1 Webnus 1 Modern Events Calendar Lite 2024-11-21 5.4 Medium
The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.
CVE-2021-25044 1 Premium-themes 1 Cryptocurrency Pricing List And Ticker 2024-11-21 6.1 Medium
The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue
CVE-2021-25043 1 Pluginus 1 Woocommerce Currency Switcher 2024-11-21 6.1 Medium
The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
CVE-2021-25041 1 10web 1 Photo Gallery 2024-11-21 6.1 Medium
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
CVE-2021-25040 1 Booking Calendar Project 1 Booking Calendar 2024-11-21 6.1 Medium
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2021-25039 1 Obtaininfotech 1 Multisite Content Copier\/updater 2024-11-21 6.1 Medium
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
CVE-2021-25038 1 Obtaininfotech 1 Multisite User Sync\/unsync 2024-11-21 6.1 Medium
The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
CVE-2021-25035 1 Revmakx 1 Backup And Staging By Wp Time Capsule 2024-11-21 6.1 Medium
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2021-25034 1 Wp User Project 1 Wp User 2024-11-21 6.1 Medium
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues
CVE-2021-25031 1 Oxilab 1 Image Hover Effects Ultimate 2024-11-21 6.1 Medium
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2021-25029 1 Cluevo 1 Learning Management System 2024-11-21 4.8 Medium
The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2021-25027 1 Ideabox 1 Powerpack Addons For Elementor 2024-11-21 6.1 Medium
The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
CVE-2021-25026 1 Patreon 1 Patreon Wordpress 2024-11-21 5.5 Medium
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2021-25024 1 Theeventscalendar 1 Eventcalendar 2024-11-21 6.1 Medium
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
CVE-2021-25019 1 Squirrly 1 Seo Plugin By Squirrly Seo 2024-11-21 6.1 Medium
The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting