Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20777 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-17140 1 Vms-studio 1 Quizlord 2024-11-21 N/A
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.
CVE-2018-17138 1 Nickelpro 1 Jibu Pro 2024-11-21 N/A
The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.
CVE-2018-17074 1 Feed Statistics Project 1 Feed Statistics 2024-11-21 N/A
The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.
CVE-2018-16967 1 Filemanagerpro 1 File Manager 2024-11-21 N/A
There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
CVE-2018-16966 1 Filemanagerpro 1 File Manager 2024-11-21 N/A
There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
CVE-2018-16613 1 Gvectors 1 Wpforo Forum 2024-11-21 N/A
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.
CVE-2018-16363 1 Filemanagerpro 1 File Manager 2024-11-21 N/A
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
CVE-2018-16308 1 Ninjaforms 1 Ninja Forms 2024-11-21 N/A
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
CVE-2018-16299 1 Localize My Post Project 1 Localize My Post 2024-11-21 N/A
The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
CVE-2018-16285 1 Userproplugin 1 Userpro 2024-11-21 N/A
The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
CVE-2018-16283 1 Wechat Brodcast Project 1 Wechat Brodcast 2024-11-21 N/A
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
CVE-2018-16259 1 Soflyy 1 Wp All Import 2024-11-21 N/A
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
CVE-2018-16258 1 Soflyy 1 Wp All Import 2024-11-21 N/A
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
CVE-2018-16257 1 Soflyy 1 Wp All Import 2024-11-21 N/A
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
CVE-2018-16256 1 Soflyy 1 Wp All Import 2024-11-21 N/A
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
CVE-2018-16255 1 Soflyy 1 Wp All Import 2024-11-21 N/A
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
CVE-2018-16254 1 Soflyy 1 Wp All Import 2024-11-21 N/A
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
CVE-2018-16206 1 Ohtanz 1 Spam-byebye 2024-11-21 N/A
Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-16159 1 Codemenschen 1 Gift Vouchers 2024-11-21 N/A
The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request.
CVE-2018-15877 1 Plainview Activity Monitor Project 1 Plainview Activity Monitor 2024-11-21 8.8 High
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.