2023

The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the si

The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attribut

The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortco

The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before output

The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of i

The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to

The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes befor

The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in

The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements

The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, wh

The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputt

The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its sho

The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes

The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attribute

The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes bef

The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes b

The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputt

The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod,

The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before

The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes be

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortc

The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attribut

The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attrib

The Meks Flexible Shortcodes WordPress plugin before 1.3.5 does not validate and escape some of its shortcode attributes

The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes b

The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL sta

The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes befo

The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputti

The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before

The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting

The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes

The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputtin

The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL

Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.

The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and

Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute ar

Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any

A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as pr

Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber

Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent

Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an

Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerabil

Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during un

In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file

Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A

NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affect

Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outsid

Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server

SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a crede

Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error han