Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20777 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-0579 1 Webdados 1 Open Graph For Facebook\, Google\+ And Twitter Card Tags 2024-11-21 N/A
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0578 1 Pixelyoursite 1 Pixelyoursite 2024-11-21 N/A
Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0577 1 Flippercode 1 Wp Google Map 2024-11-21 5.4 Medium
Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0576 1 Pixelite 1 Events Manager 2024-11-21 N/A
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0547 1 Soflyy 1 Wp All Import 2024-11-21 N/A
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0546 1 Soflyy 1 Wp All Import 2024-11-21 N/A
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-6514 1 Wordpress 1 Wordpress 2024-11-21 N/A
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.
CVE-2017-20183 1 External Media Without Import Project 1 External Media Without Import 2024-11-21 3.5 Low
A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of the argument url/error/width/height/mime-type leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The patch is identified as 9d2ecd159a6e2e3f710b4f1c28e2714f66502746. It is recommended to upgrade the affected component. VDB-227950 is the identifier assigned to this vulnerability.
CVE-2017-20008 1 Mycred 1 Mycred 2024-11-21 6.1 Medium
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting
CVE-2017-18634 1 Tagdiv 1 Newspaper 2024-11-21 9.8 Critical
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
CVE-2017-18615 1 Wp-kama 1 Kama Click Counter 2024-11-21 6.1 Medium
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
CVE-2017-18614 1 Wp-kama 1 Kama Click Counter 2024-11-21 8.1 High
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
CVE-2017-18613 1 Trust Form Project 1 Trust Form 2024-11-21 6.1 Medium
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
CVE-2017-18612 1 Netattingo 1 Wp-whois-domain 2024-11-21 6.1 Medium
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
CVE-2017-18611 1 Magicfields 1 Magic Fields 2024-11-21 6.1 Medium
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
CVE-2017-18610 1 Magicfields 1 Magic Fields 2024-11-21 6.1 Medium
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
CVE-2017-18609 1 Magicfields 1 Magic Fields 2024-11-21 6.1 Medium
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
CVE-2017-18608 1 Spot 1 Spot.im Comments 2024-11-21 6.1 Medium
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
CVE-2017-18607 1 Theme-fusion 1 Avada 2024-11-21 8.8 High
The avada theme before 5.1.5 for WordPress has CSRF.
CVE-2017-18606 1 Theme-fusion 1 Avada 2024-11-21 6.1 Medium
The avada theme before 5.1.5 for WordPress has stored XSS.