CVE Vulnerability Catalog

The Image Editor by Pixo WordPress plugin contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows malicious script execution in the user's browser.

The Bitly WordPress plugin contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows persistent injection of malicious scripts.

The ZoloBlocks plugin contains a DOM-Based XSS vulnerability in versions up to and including 2.3.12. An attacker can exploit this to execute malicious scripts in the user's browser.

The Sitekit plugin contains a Stored XSS vulnerability in versions up to and including 2.0. An attacker can inject a malicious script that executes every time the page is viewed.

The Quick View for WooCommerce plugin up to version 2.2.16 contains a Stored XSS vulnerability. The issue arises from improper neutralization of input during web page generation.

The Podlove Subscribe button plugin contains a Stored XSS vulnerability in versions up to and including 1.3.11. An attacker can inject a malicious script that executes in the user's browser.

The WordPress plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery (versions up to and including 1.16.16) contains an Insertion of Sensitive Information Into Sent Data vulnerability. This may allow retrieval of embedded sensitive data.

CSRF vulnerability in the Printeers Print & Ship plugin. Allows an attacker to perform unauthorized requests on behalf of an administrator.

Stored XSS vulnerability in VoucherPress plugin (up to 1.5.7) due to improper input neutralization. Allows persistent script injection that executes in the user's browser.

Missing Authorization vulnerability in Dynamic Web Lab Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team Manager from n/a through 2.6.8.

Missing Authorization vulnerability in PilotPress (versions up to 2.0.36) allows exploiting incorrectly configured access control security levels.

The Card Elements for WPBakery WordPress plugin contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows malicious script execution in the user's browser.

CSRF vulnerability in LIJE Show Pages List (show-pages-list) allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 1.2.0.

CSRF vulnerability in Bage Flexible FAQ (flexible-faq) allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 0.2.

The Fastly WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.2.28. This may allow an attacker to force unintended actions on behalf of an authenticated user.

The Draft website-builder plugin up to version 3.0.9 contains a Stored XSS vulnerability. The issue arises from improper neutralization of input during web page generation.

CSRF vulnerability in Bytes.co WP Compiler (wp-compiler) allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 1.0.0.

The Nextend Facebook Connect plugin contains a Stored XSS vulnerability in versions up to and including 3.1.19. An attacker can inject a malicious script that executes in the user's browser.

The Page-list plugin by webvitaly has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 5.8.

The Classic Widgets with Block-based Widgets plugin (versions up to and including 1.0.1) contains a Missing Authorization vulnerability that allows access to functionality not properly constrained by ACLs. A low-privileged user may perform actions they should not have access to.