Browse CVEs

MEDIUM 5.4 CVE-2025-46239 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows S… Theme Switcha 3.4.1+ Fix from $1,6002025-04-22 MEDIUM 5.4 CVE-2025-46240 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-downl… Simple Download Counter 2.2.1+ Fix from $1,6002025-04-22 MEDIUM 6.1 CVE-2024-0979 The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and i… Dashboard Widgets Suite 3.4.4+ Fix from $1,6002024-06-13 MEDIUM 5.4 CVE-2024-2470 The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such… Simple Ajax Chat 20240412+ Fix from $1,6002024-06-04 HIGH 7.1 CVE-2024-1983 The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflec… Simple Ajax Chat 20240223+ Fix from $1,9502024-03-20 CRITICAL 9.8 CVE-2023-45603 Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.Th… User Submitted Posts after 20230902 Fix from $2,3002023-12-20 MEDIUM 5.4 CVE-2023-5614 The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all versions u… Theme Switcha after 3.3 Fix from $1,6002023-10-20 MEDIUM 5.4 CVE-2023-4838 The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and incl… Simple Download Counter after 1.6 Fix from $1,6002023-09-09 MEDIUM 5.4 CVE-2023-4779 The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to… User Submitted Posts after 20230811 Fix from $1,6002023-09-06 MEDIUM 5.4 CVE-2023-4308 The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up … User Submitted Posts 20230811+ Fix from $1,6002023-08-15 CRITICAL 9.8 CVE-2019-25138 The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images fun… User Submitted Posts after 20190312 Fix from $2,3002023-06-07 HIGH 7.5 CVE-2022-27849 Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115 Simple Ajax Chat after 20220115 Fix from $1,9502022-04-15 CRITICAL 9.1 CVE-2022-1165 The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests… Blackhole For Bad Bots 3.3.2+ Fix from $2,3002022-04-04 MEDIUM 6.1 CVE-2022-25610 Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack… Simple Ajax Chat 20220115+ Fix from $1,6002022-03-25 MEDIUM 6.1 CVE-2022-25601 Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4). Contact Form X 2.4.1+ Fix from $1,6002022-03-11 MEDIUM 6.1 CVE-2021-24409 The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected C… Prismatic 2.8+ Fix from $1,6002021-07-12 MEDIUM 5.4 CVE-2021-24408 The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contri… Prismatic 2.8+ Fix from $1,6002021-07-12 MEDIUM 6.1 CVE-2016-11001 The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. User Submitted Posts 20160215+ Fix from $1,6002019-09-20