CVE-2023-23799

WordPress Easy Panorama Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Leonardo Giacone Easy Panorama plugin <= 1.1.4 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Easy Panorama Project

Products

Easy Panorama

CVE-2023-27620

WordPress Robo Gallery Plugin <= 3.2.12 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-site Scripting (XSS) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.12 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Robogallery

Products

Robo Gallery

CVE-2023-28792

WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

I13websolution

Products

Continuous Image Carosel With Lightbox

CVE-2023-29172

WordPress PropertyHive Plugin <= 1.5.46 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.46 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wp-property-hive

Products

Propertyhive

CVE-2023-29170

WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in PI Websolution Product Enquiry for WooCommerce, WooCommerce product catalog plugin <= 2.2.12 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Piwebsolution

Products

Product Enquiry For Woocommerce

CVE-2023-29388

WordPress Product Catalog Simple Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Implecode

Products

Product Catalog Simple

CVE-2025-0213

Campcodes Project Management System update_forms.php unrestricted upload

A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forms/update_forms.php?action=change_pic2&id=4. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Project Management System

CVE-2022-45358

WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Colorlib

Products

Activello

CVE-2023-27610

WordPress Transbank Webpay REST Plugin <= 1.6.6 is vulnerable to SQL Injection

Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Transbank

Products

Transbank Webpay Rest

CVE-2023-30474

WordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ultimate Noindex Nofollow Tool Ii Project

Products

Ultimate Noindex Nofollow Tool Ii

CVE-2023-22687

WordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin <= 1.9.4.0 is vulnerable to Sensitive Data Exposure

Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Freesoul Deactivate Plugins - Plugin Manager And Cleanup Project

Products

Freesoul Deactivate Plugins - Plugin Manager And Cleanup

CVE-2022-43458

WordPress Advanced Floating Content Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Code Tides Advanced Floating Content plugin <= 1.2.1 versions.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Codetides

Products

Advanced Floating Content

CVE-2023-2972

Prototype Pollution in antfu/utils

Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Antfu

Products

Utils

CVE-2022-44734

WordPress Car Rental by BestWebSoft Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bestwebsoft

Products

Car Rental

CVE-2022-45849

WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Colorlib

Products

Activello Theme

CVE-2022-45838

WordPress ARForms Form Builder Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARForms Form Builder plugin <= 1.5.5 versions.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Reputeinfosystems

Products

Arforms Form Builder

CVE-2022-44632

WordPress Content Repeater – Custom Posts Simplified Plugin <= 1.1.13 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin <= 1.1.13 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Content-repeater Project

Products

Content-repeater

CVE-2022-44631

WordPress 1app Business Forms Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

1app

Products

1app Business Forms

CVE-2022-44582

WordPress Apptivo Business Site CRM Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apptivo Apptivo Business Site CRM plugin <= 3.0.12 versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Apptivo

Products

Apptivo Business Site Crm

CVE-2024-50339

GLPI vulnerable to unauthenticated session hijacking

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

CVSS 4.0 · 9.3 Critical EPSS 18.7% KEV · Not listed

Vendors

Glpi-project

Products

Glpi