Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,979

CVE-2022-1591

WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRF

The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Ping Optimizer Project
Products
Wordpress Ping Optimizer
CVE-2022-1587

pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Netapp Pcre and 1 more
Products
Fedora Active Iq Unified Manager H300s and 14 more
CVE-2022-1585

Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download

The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Project-source-code-download Project
Products
Project-source-code-download
CVE-2022-1584

Reflected XSS in microweber/microweber

Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Microweber
Products
Microweber
CVE-2022-1583

External Links in New Window / New Tab < 1.43 - Tabnabbing

The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Webfactoryltd
Products
External Links In New Window \/ New Tab
CVE-2022-1582

External Links in New Window / New Tab < 1.43 - Unauthenticated Stored Cross-Site Scripting

The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webfactoryltd
Products
External Links In New Window \/ New Tab
CVE-2022-1580

Site Offline < 1.5.3 - Access Bypass

The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Freehtmldesigns
Products
Site Offline
CVE-2022-1577

Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF

The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Deliciousbrains
Products
Database Backup
CVE-2022-1576

WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themeisle
Products
Wp Maintenance Mode \& Coming Soon
CVE-2022-1575

Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio

Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.

CVSS 3.1 · 9.6 Critical EPSS 2.4% KEV · Not listed
Vendors
Diagrams
Products
Drawio
CVE-2022-1574

HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server

CVSS 3.1 · 9.8 Critical EPSS 12.2% KEV · Not listed
Vendors
Html2wp Project
Products
Html2wp
CVE-2022-1573

HTML2WP <= 1.0.0 - Arbitrary Settings Update via CSRF

The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Html2wp Project
Products
Html2wp
CVE-2022-1572

HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Html2wp Project
Products
Html2wp
CVE-2022-1571

Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts

Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Facturascripts
Products
Facturascripts
CVE-2022-1570

Files Download Delay < 1.0.7 - Subscriber+ Settings Reset

The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Files Download Delay Project
Products
Files Download Delay
CVE-2022-1569

WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting

The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pieforms
Products
Drag \& Drop Builder
CVE-2022-1568

Team Members < 5.1.1 - Admin+ Stored Cross-Site Scripting

The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wpdarko
Products
Team Members
CVE-2022-1566

Quotes llama < 1.0.0 - Admin+ Stored Cross-Site Scripting

The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Quotes Llama Project
Products
Quotes Llama
CVE-2022-1564

Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS 1.1% KEV · Not listed
Vendors
10web
Products
Form Maker
CVE-2022-1562

Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG

The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Room 34 Creative Services
Products
Enable Svg