Total
35944 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-24494 | 1 Remyandrade | 1 Daily Habit Tracker | 2025-05-15 | 6.1 Medium |
| Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components. | ||||
| CVE-2024-24397 | 1 Stimulsoft | 1 Dashboards.js | 2025-05-15 | 5.4 Medium |
| Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field. | ||||
| CVE-2024-21485 | 1 Plotly | 1 Dash | 2025-05-15 | 6.5 Medium |
| Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server. **Note:** This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user. | ||||
| CVE-2023-39683 | 1 Zalify | 1 Easy Email | 2025-05-15 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s). NOTE: Researcher claims issue is present in all versions prior and later than tested version. | ||||
| CVE-2025-2299 | 1 Theluckywp | 1 Luckywp Table Of Contents | 2025-05-15 | 6.1 Medium |
| The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the 'ajaxEdit' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||||
| CVE-2024-1215 | 1 Crud Without Page Reload Project | 1 Crud Without Page Reload | 2025-05-15 | 3.5 Low |
| A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file fetch_data.php. The manipulation of the argument username/city leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252782 is the identifier assigned to this vulnerability. | ||||
| CVE-2024-10472 | 1 Stylishpricelist | 1 Stylish Price List | 2025-05-15 | 5.9 Medium |
| The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-10554 | 1 Internet-formation | 1 Wp-advanced-search | 2025-05-15 | 3.5 Low |
| The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-10703 | 1 Roundupwp | 1 Registrations For The Events Calendar | 2025-05-15 | 6.1 Medium |
| The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-11272 | 1 Wpforms | 1 Pirate Forms | 2025-05-15 | 6.1 Medium |
| The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-11273 | 1 Wpforms | 1 Contact Form | 2025-05-15 | 6.1 Medium |
| The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-3026 | 1 Maxfoundry | 1 Maxbuttons | 2025-05-15 | 5.4 Medium |
| The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks | ||||
| CVE-2024-4269 | 2 Boldblocks, Phiphan | 2 Svg Block, Svg Block | 2025-05-15 | 6.1 Medium |
| The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. | ||||
| CVE-2024-4272 | 1 Sayedulsayem | 1 Support Svg | 2025-05-15 | 6.1 Medium |
| The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. | ||||
| CVE-2024-4602 | 1 Info-d-74 | 1 Embed Peertube Playlist | 2025-05-15 | 5.4 Medium |
| The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-4752 | 1 Myeventon | 1 Eventon | 2025-05-15 | 5.9 Medium |
| The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2022-42715 | 1 Vanderbilt | 1 Redcap | 2025-05-15 | 6.1 Medium |
| A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution. | ||||
| CVE-2022-42711 | 1 Progress | 1 Whatsup Gold | 2025-05-15 | 9.6 Critical |
| In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. | ||||
| CVE-2024-52318 | 1 Apache | 1 Tomcat | 2025-05-15 | 6.1 Medium |
| Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue. | ||||
| CVE-2024-46055 | 2 Davidguva, Openvidreview Project | 2 Openvidreview, Openvidreview | 2025-05-15 | 4.8 Medium |
| OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names. | ||||