2023

The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes

The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before

The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before out

The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before out

The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes b

The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outpu

The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes befor

The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes

The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, whi

The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could

The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attr

The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes befor

The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allo

The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attr

The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputti

The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before

The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before ou

The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attribute

The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting the

The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place wh

The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes

The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before

The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputtin

The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before

The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before

The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before

The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allo

The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used

The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenti

An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by c

The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allo

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the docume

The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow user

Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.

app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.

An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal.

processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of siz

Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgcon

KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file,

A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2

In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.

In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.

When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.

An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service.

The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability