2023

The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a par

The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputt

The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outpu

The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes bef

The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before ou

The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before out

The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape s

The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outp

The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shor

The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes be

The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before ou

The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before out

The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode att

The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes befor

The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before

The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before

Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes befo

The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attrib

The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outp

The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before o

The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before

The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL sta

The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its s

The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputtin

The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow hi

The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting

The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers t

The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high pri

The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back i

The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX a

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, makin

Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section

The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users su

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. Aff

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.

A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some un

A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_

A vulnerability classified as critical was found in Events Extension on BigTree. Affected by this vulnerability is the f

A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown fu

When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticat

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue a

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by aut

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vec

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a speci

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the functio

A vulnerability, which was classified as critical, was found in antonbolling clan7ups. Affected is an unknown function o