Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20778 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-7422 1 Siteeditor 1 Site Editor 2024-11-21 N/A
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
CVE-2018-7280 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
CVE-2018-7204 1 Giribaz 1 File Manager 2024-11-21 N/A
inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites.
CVE-2018-6944 1 Ultimatemember 1 Ultimate Member 2024-11-21 N/A
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
CVE-2018-6943 1 Ultimatemember 1 Ultimatemember 2024-11-21 N/A
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
CVE-2018-6891 1 Booking-wp-plugin 1 Bookly 2024-11-21 6.1 Medium
Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.
CVE-2018-6469 1 Flickrrss Project 1 Flickrrss 2024-11-21 N/A
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_tags parameter to wp-admin/options-general.php.
CVE-2018-6468 1 Flickrrss Project 1 Flickrrss 2024-11-21 N/A
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_id parameter to wp-admin/options-general.php.
CVE-2018-6467 1 Flickrrss Project 1 Flickrrss 2024-11-21 N/A
The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.
CVE-2018-6466 1 Flickrrss Project 1 Flickrrss 2024-11-21 N/A
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_set parameter to wp-admin/options-general.php.
CVE-2018-6465 1 Wp-property-hive 1 Propertyhive 2024-11-21 N/A
The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.
CVE-2018-6389 1 Wordpress 1 Wordpress 2024-11-21 N/A
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
CVE-2018-6357 1 Acurax 1 Social Media Widget 2024-11-21 N/A
The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.
CVE-2018-6195 1 Splashing Images Project 1 Splashing Images 2024-11-21 7.2 High
admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.
CVE-2018-6194 1 Splashing Images Project 1 Splashing Images 2024-11-21 N/A
A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php.
CVE-2018-6015 1 Icegram 1 Email Subscribers \& Newsletters 2024-11-21 N/A
An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data.
CVE-2018-6002 1 Webartisan 1 Soundy Background Music 2024-11-21 N/A
The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter).
CVE-2018-6001 1 Webartisan 1 Soundy Audio Playlist 2024-11-21 N/A
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).
CVE-2018-5776 1 Wordpress 1 Wordpress 2024-11-21 N/A
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
CVE-2018-5695 1 Wpjobboard 1 Wpjobboard 2024-11-21 N/A
The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php.