Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20782 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-17236 1 Getigniteup 1 Igniteup 2024-11-21 6.1 Medium
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.
CVE-2019-17235 1 Getigniteup 1 Igniteup 2024-11-21 5.3 Medium
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.
CVE-2019-17234 1 Getigniteup 1 Igniteup 2024-11-21 7.5 High
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
CVE-2019-17233 1 Etoilewebdesign 1 Ultimate Faq 2024-11-21 6.1 Medium
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
CVE-2019-17232 1 Etoilewebdesign 1 Ultimate Faq 2024-11-21 7.5 High
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
CVE-2019-17231 1 Mageewp 1 Onetone 2024-11-21 6.1 Medium
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
CVE-2019-17230 1 Mageewp 1 Onetone 2024-11-21 5.3 Medium
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
CVE-2019-17229 1 Stylemixthemes 1 Motors - Car Dealer\, Classifieds \& Listing 2024-11-21 6.1 Medium
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
CVE-2019-17228 1 Stylemixthemes 1 Motors - Car Dealer\, Classifieds \& Listing 2024-11-21 6.5 Medium
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
CVE-2019-17214 1 Webarxsecurity 1 Webarx 2024-11-21 7.5 High
The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI.
CVE-2019-17213 1 Webarxsecurity 1 Webarx 2024-11-21 6.1 Medium
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
CVE-2019-17207 1 Managewp 1 Broken Link Checker 2024-11-21 5.4 Medium
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
CVE-2019-17072 1 Awplife 1 Contact Form Widget 2024-11-21 9.8 Critical
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
CVE-2019-17071 1 Realbigplugins 1 Client Dash 2024-11-21 6.1 Medium
The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.
CVE-2019-17070 2 Lqd, Microsoft 2 Liquid Speech Balloon, Internet Explorer 2024-11-21 6.1 Medium
The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.
CVE-2019-16932 1 Themeisle 1 Visualizer 2024-11-21 10.0 Critical
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.
CVE-2019-16931 1 Themeisle 1 Visualizer 2024-11-21 6.1 Medium
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
CVE-2019-16902 1 Reputeinfosystems 1 Arforms 2024-11-21 7.5 High
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
CVE-2019-16781 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 5.8 Medium
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
CVE-2019-16780 2 Debian, Wordpress 2 Debian Linux, Wordpress 2024-11-21 5.8 Medium
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.