Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43387 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-25035 1 Revmakx 1 Backup And Staging By Wp Time Capsule 2024-11-21 6.1 Medium
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2021-25034 1 Wp User Project 1 Wp User 2024-11-21 6.1 Medium
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues
CVE-2021-25031 1 Oxilab 1 Image Hover Effects Ultimate 2024-11-21 6.1 Medium
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2021-25029 1 Cluevo 1 Learning Management System 2024-11-21 4.8 Medium
The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2021-25027 1 Ideabox 1 Powerpack Addons For Elementor 2024-11-21 6.1 Medium
The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
CVE-2021-25026 1 Patreon 1 Patreon Wordpress 2024-11-21 5.5 Medium
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2021-25024 1 Theeventscalendar 1 Eventcalendar 2024-11-21 6.1 Medium
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
CVE-2021-25019 1 Squirrly 1 Seo Plugin By Squirrly Seo 2024-11-21 6.1 Medium
The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2021-25017 1 Themeum 1 Tutor Lms 2024-11-21 6.1 Medium
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2021-25016 1 Premio 2 Chaty, Chaty Pro 2024-11-21 6.1 Medium
The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
CVE-2021-25015 1 Mycred 1 Mycred 2024-11-21 6.1 Medium
The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue
CVE-2021-25012 1 Popozure 1 Pz-linkcard 2024-11-21 6.1 Medium
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
CVE-2021-25008 1 Codesnippets 1 Code Snippets 2024-11-21 6.1 Medium
The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue
CVE-2021-25006 1 Molie Instructure Canvas Linking Tool Project 1 Molie Instructure Canvas Linking Tool 2024-11-21 6.1 Medium
The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
CVE-2021-25005 1 Seur Oficial Project 1 Seur Oficial 2024-11-21 4.8 Medium
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVE-2021-25001 1 Booster 1 Booster For Woocommerce 2024-11-21 6.1 Medium
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue
CVE-2021-25000 1 Booster 1 Booster For Woocommerce 2024-11-21 6.1 Medium
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue
CVE-2021-24999 1 Booster 1 Booster For Woocommerce 2024-11-21 6.1 Medium
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting
CVE-2021-24996 1 Wki 1 Idpay For Contact Form 7 2024-11-21 6.1 Medium
The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting
CVE-2021-24995 1 Html5 Responsive Faq Project 1 Html5 Responsive Faq 2024-11-21 4.8 Medium
The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed