Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20777 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-11526 1 Webtoffee 1 Wordpress Comments Import And Export 2024-11-21 N/A
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
CVE-2018-11525 1 Algolplus 1 Advanced Order Export For Woocommerce 2024-11-21 N/A
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
CVE-2018-11515 1 Gvectors 1 Wpforo 2024-11-21 N/A
The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.
CVE-2018-11486 1 Multidots 1 Advance Search For Woocommerce 2024-11-21 N/A
An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.
CVE-2018-11485 1 Multidots 1 Woocommerce Quick Reports 2024-11-21 N/A
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the "referral_site" cookie to have an XSS payload, and placing an order.
CVE-2018-11366 1 Loginizer 1 Loginizer 2024-11-21 N/A
init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0.
CVE-2018-11309 1 Membermouse 1 Membermouse 2024-11-21 N/A
Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request.
CVE-2018-11244 1 Dopewp 1 Bbe Theme 2024-11-21 N/A
The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor.
CVE-2018-11105 1 3cx 1 Live Chat 2024-11-21 N/A
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.
CVE-2018-10969 1 Genetechsolutions 1 Pie Register 2024-11-21 N/A
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.
CVE-2018-10752 1 Tagregator Project 1 Tagregator 2024-11-21 N/A
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
CVE-2018-10504 1 Web-dorado 1 Form Maker 2024-11-21 N/A
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
CVE-2018-10371 1 Wunderfarm 1 Wf Cookie Consent 2024-11-21 N/A
An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a page title.
CVE-2018-10363 1 Wpdevart 1 Booking Calendar 2024-11-21 N/A
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
CVE-2018-10310 1 Catapultthemes 1 Cookie Consent 2024-11-21 N/A
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser.
CVE-2018-10309 1 Responsive Cookie Consent Project 1 Responsive Cookie Consent 2024-11-21 N/A
The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
CVE-2018-10301 1 Web-dorado 1 Wd Instagram Feed 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.
CVE-2018-10300 1 Web-dorado 1 Wd Instagram Feed 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.
CVE-2018-10234 1 Ultimatemember 1 User Profile \& Membership 2024-11-21 N/A
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page.
CVE-2018-10233 1 Ultimatemember 1 User Profile \& Membership 2024-11-21 N/A
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin.