Total
42233 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-6487 | 1 Data443 | 1 Inline Related Posts | 2025-05-30 | N/A | 5.9 MEDIUM |
|
The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
|
|||||
| CVE-2024-6021 | 1 Bharatkambariya | 1 Donation Block For Paypal | 2025-05-30 | N/A | 6.8 MEDIUM |
|
The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability
|
|||||
| CVE-2024-3113 | 1 Devsabbirahmed | 1 Simple Form | 2025-05-30 | N/A | 5.9 MEDIUM |
|
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
|
|||||
| CVE-2024-34000 | 1 Moodle | 1 Moodle | 2025-05-30 | N/A | 4.3 MEDIUM |
|
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.
|
|||||
| CVE-2024-33998 | 1 Moodle | 1 Moodle | 2025-05-30 | N/A | 5.4 MEDIUM |
|
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
|
|||||
| CVE-2024-33997 | 1 Moodle | 1 Moodle | 2025-05-30 | N/A | 6.1 MEDIUM |
|
Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.
|
|||||
| CVE-2025-5259 | 2025-05-30 | N/A | 6.4 MEDIUM | ||
|
The Minimal Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
|
|||||
| CVE-2025-4989 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4992 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4983 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4985 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4984 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4991 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4944 | 2025-05-30 | N/A | 6.4 MEDIUM | ||
|
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widgets in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
|
|||||
| CVE-2025-0602 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4988 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4986 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2025-4990 | 2025-05-30 | N/A | 8.7 HIGH | ||
|
A stored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
|
|||||
| CVE-2023-41103 | 1 Interactsoftware | 1 Interact | 2025-05-30 | N/A | 5.4 MEDIUM |
|
Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload.
|
|||||
| CVE-2023-35792 | 1 Vound-software | 1 Intella Connect | 2025-05-30 | N/A | 5.4 MEDIUM |
|
Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS).
|
|||||
| CVE-2023-31223 | 1 Dradisframework | 1 Dradis | 2025-05-30 | N/A | 8.7 HIGH |
|
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.
|
|||||
| CVE-2022-38481 | 1 Mega | 1 Hopex | 2025-05-30 | N/A | 6.1 MEDIUM |
|
An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features.
|
|||||
| CVE-2022-37028 | 1 Iris | 1 Isams | 2025-05-30 | N/A | 5.4 MEDIUM |
|
ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will be executed when another user uses the application.
|
|||||
| CVE-2022-29931 | 1 Raytion | 1 Custom Security Manager | 2025-05-30 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS).
|
|||||
| CVE-2022-24967 | 1 Blackrainbow | 1 Nimbus | 2025-05-30 | 3.5 LOW | 6.5 MEDIUM |
|
Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting (XSS).
|
|||||
| CVE-2019-6514 | 1 Wso2 | 1 Dashboard Server | 2025-05-30 | 3.5 LOW | 4.8 MEDIUM |
|
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS.
|
|||||
| CVE-2018-10213 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | 3.5 LOW | 5.4 MEDIUM |
|
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a different user, who can modify the HTML in that mail before sending it.
|
|||||
| CVE-2018-10209 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | 3.5 LOW | 5.4 MEDIUM |
|
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder download pop-up via a crafted file or folder name.
|
|||||
| CVE-2018-10208 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI.
|
|||||
| CVE-2018-10206 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | 3.5 LOW | 5.4 MEDIUM |
|
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message field of a file request.
|
|||||
| CVE-2024-3580 | 1 Ivanweb | 1 Popup4phone | 2025-05-30 | N/A | 6.1 MEDIUM |
|
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
|
|||||
| CVE-2024-3231 | 1 Ivanweb | 1 Popup4phone | 2025-05-30 | N/A | 6.1 MEDIUM |
|
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
|
|||||
| CVE-2024-2761 | 1 Wpengine | 1 Genesis Blocks | 2025-05-30 | N/A | 6.8 MEDIUM |
|
The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks.
|
|||||
| CVE-2024-2309 | 1 Wp-staging | 1 Wp Staging | 2025-05-30 | N/A | 4.8 MEDIUM |
|
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
|
|||||
| CVE-2024-4924 | 1 Heateor | 1 Sassy Social Share | 2025-05-30 | N/A | 6.1 MEDIUM |
|
The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
|
|||||
| CVE-2025-48252 | 1 Wpfactory | 1 Back Button Widget | 2025-05-30 | N/A | 6.5 MEDIUM |
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS. This issue affects Back Button Widget: from n/a through 1.6.8.
|
|||||
| CVE-2024-23725 | 1 Ghost | 1 Ghost | 2025-05-30 | N/A | 6.1 MEDIUM |
|
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.
|
|||||
| CVE-2024-23387 | 1 Fusionpbx | 1 Fusionpbx | 2025-05-30 | N/A | 4.8 MEDIUM |
|
FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product.
|
|||||
| CVE-2024-22497 | 1 Jfinalcms Project | 1 Jfinalcms | 2025-05-30 | N/A | 6.1 MEDIUM |
|
Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
|
|||||
| CVE-2023-7194 | 1 Meris Wp Theme Project | 1 Meris Wp Theme | 2025-05-30 | N/A | 6.1 MEDIUM |
|
The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
|
|||||