CVE Vulnerability Catalog

The Ninja Forms Contact Form plugin versions up to 3.6.25 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The WPFunnels plugin for WordPress versions up to 2.7.16 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The Radio Forge Muses Player with Skins plugin in versions <= 2.5 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The RadiusTheme Variation Swatches for WooCommerce plugin versions <= 2.3.7 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The MF Gig Calendar plugin versions <= 1.2 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor privileges and above.

The RadiusTheme Variation Images Gallery plugin for WooCommerce versions <= 2.3.3 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The WpStream plugin has a Cross-Site Request Forgery (CSRF) vulnerability, allowing unauthorized actions on behalf of the user. This issue affects versions from n/a to 4.5.4.

The wpShopGermany IT-RECHT KANZLEI plugin versions <= 1.7 has an authenticated stored Cross-Site Scripting (XSS) vulnerability.

The WPKube Authors List plugin versions <= 2.0.2 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The Gravity Master Custom Field for WP Job Manager plugin versions <= 1.1 has an authenticated (admin+) stored Cross-Site Scripting (XSS) vulnerability.

A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.0 that allows cross site scripting (XSS) attacks through manipulation of the img argument in the file /index.php?controller=GzUser&action=edit&id=1. The attack can be initiated remotely.

A vulnerability has been found in GZ Scripts Availability Booking Calendar PHP 1.0 that allows cross site scripting (XSS) attacks through manipulation of the promo_code argument in the index.php file. The attack can be launched remotely.

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized data modification due to insufficient restrictions on the 'apg_profile_update' function in versions up to and including 1.9. This allows authenticated attackers with subscriber-level permissions or above to arbitrarily update user metas.

The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the 'events_receiver' function in versions up to and including 0.0.9.18. This allows unauthenticated attackers to add, modify, or delete posts and taxonomies, install, activate, or deactivate plugins, change customizer settings, and manage users, including administrator users.

The issue was addressed with improved memory handling. This issue may lead to arbitrary code execution when processing web content.

The issue was addressed with additional permissions checks. An app may be able to access user-sensitive data.

The issue was addressed with improved checks. A remote user may be able to cause a denial-of-service.

A permissions issue was addressed with additional restrictions. An app may be able to modify protected parts of the file system.

The issue was addressed with improved checks. This issue may lead to arbitrary code execution when processing web content.

The issue was addressed with improved checks. This issue may lead to arbitrary code execution when processing web content.