Category
Web / CMS
26,715 known vulnerabilities.
1,140 results · Clear filters · Feed
-
Unscored —
WPCargo < 6.9.0 - Unauthenticated RCE
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
-
Unscored —CVE-2021-24966 Public exploit
Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing
The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder
-
Unscored —CVE-2021-24959 Public exploit
WP Email Users <= 1.7.6 - Subscriber+ SQL Injection
The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.
-
Unscored —CVE-2022-0448 Public exploit
CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting
The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
-
Unscored —
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin
-
Unscored —CVE-2022-0439 Public exploit
Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscrib…
-
Unscored —CVE-2022-23988 Public exploit
WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
-
Unscored —CVE-2022-0377 Public exploit
LearnPress < 4.1.5 - Arbitrary Image Renaming
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the ser…
-
Unscored —CVE-2021-24901 Public exploit
Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Critical 9.8
WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inj…
-
Critical 9.8
Adobe Commerce checkout improper input validation leads to remote code execution
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code e…
KEV Feb 15, 2022 -
High 8.8CVE-2022-25174 Public exploit
Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller thr…
-
High 8.8CVE-2022-25173 Public exploit
Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS co…
-
High 8.8CVE-2022-25175 Public exploit
Jenkins Pipeline: Multibranch Plugin vulnerable to OS Command Injection
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through craft…
-
Unscored —CVE-2021-24904 Public exploit
Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered…
-
Unscored —
Domain Check < 1.0.17 - Reflected Cross-Site Scripting
The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue
-
Unscored —
Perfect Survey < 1.5.2 - Unauthenticated SQL Injection
The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
-
Critical 9.8
SQL injection in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
-
Unscored —
WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also l…
-
High 7.5CVE-2022-0236 Public exploit
WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-…
-
High 8.8CVE-2022-20617 Public exploit
OS command execution vulnerability in Jenkins Docker Commons Plugin
Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configur…
-
Unscored —
RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
-
Unscored —CVE-2021-25032 Public exploit
PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to…
-
High 8.0
SQL injection in WordPress
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain wa…
-
High 7.2
Download Monitor < 4.4.5 - Admin+ SQL Injection
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
-
Unscored —
WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform …
-
Unscored —
Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL inj…
-
High 7.5
Grafana path traversal
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…
KEV Oct 9, 2025 -
High 7.5CVE-2021-43789 Public exploit
Blind SQLi using Search filters in PrestaShop
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.
-
Unscored —
Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL sta…
-
Unscored —
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.
-
Unscored —
Elementor < 3.4.8 - DOM Cross-Site-Scripting
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
-
Medium 6.5CVE-2021-43408 Public exploit
Duplicate Post WordPress Plugin SQL Injection Vulnerability
The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read,…
-
High 8.8
WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malic…
-
Unscored —CVE-2021-24807 Public exploit
Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically e…
-
Unscored —CVE-2021-24664 Public exploit
WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site Scripting
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
-
Unscored —CVE-2021-24647 Public exploit
Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site b…
-
Unscored —CVE-2021-24884 Public exploit
Formidable Form Builder < 4.09.05 - Unauthenticated Stored Cross-Site Scripting
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-in…
-
High 7.2
Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it …
-
Unscored —CVE-2021-24719 Public exploit
Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS)
The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder.