Stored cross-site scripting in BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in All Currencies for WooCommerce plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
DOM-based cross-site scripting in NickDuncan Contact Form plugin for WordPress ≤2.0.12 allows authenticated low-privilege users to inject arbitrary web scripts. When a higher-privilege user interacts with the malicious content, the script executes in their browser, potentially compromising the session. EPSS indicates very low exploitation likelihood (0.05%), and no active exploitation or public PoC is currently known.
Stored cross-site scripting in YouTube Simple Gallery WordPress plugin up to version 2.2.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in The Holiday Calendar WordPress plugin up to version 1.18.2.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
DOM-Based Cross-Site Scripting (XSS) in Simple Google Static Map plugin for WordPress versions up to 1.0.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).
Stored cross-site scripting in The Plus Addons for Elementor Page Builder Lite up to version 6.2.7 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in PickPlugins Wishlist plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into wishlist pages. Affects versions through 1.0.43. No public exploit or active exploitation identified.
Stored cross-site scripting in WidgetKit for Elementor allows authenticated attackers with contributor-level access to inject malicious scripts via widget settings. The vulnerability affects all versions up to 2.5.4 and can lead to session hijacking or defacement when an admin views the compromised page. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Ocean Extra WordPress plugin up to version 2.4.8 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in Nasa Core WordPress plugin before 6.4.1 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified, and EPSS score is low (0.05%).
Stored cross-site scripting (XSS) in WP Social Widget through version 2.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Runners Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The BNS Featured Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Freemind Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'freemind' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A security vulnerability in all (CVSS 6.4). Remediation should follow standard vulnerability management procedures.
The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Cross-Site Request Forgery in WP-Recall plugin for WordPress allows privilege escalation. An attacker can trick an authenticated admin into performing unintended actions, potentially gaining elevated access. No public exploit or active exploitation identified.
Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability.
Command injection in Tenda CP3 camera firmware 11.10.00.2311090948 allows remote authenticated attackers to execute arbitrary commands via the sub_F3C8C function in the apollo file. Public exploit code is available, and EPSS score is 0.88% (75th percentile), indicating moderate exploitation likelihood.
Path traversal in iSoluçõesWEB up to 20250516 allows authenticated attackers to read arbitrary files via the nomeArquivo parameter in /sys/up.upload.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.17%), indicating limited exploitation likelihood.
Unrestricted file upload in SourceCodester Open Source Clinic Management System 1.0 allows remote authenticated attackers to upload arbitrary files via the website_image parameter in /manage_website.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.10%), indicating limited exploitation likelihood.
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is triggered via a crafted request and requires user interaction. A public exploit is available, but no active exploitation has been reported.
SQL injection in PHPGurukul Employee Record Management System 1.3 allows authenticated remote attackers to manipulate database queries via the 'emp3ctc' parameter in /myexp.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low (0.06%).
SQL injection in PHPGurukul BP Monitoring Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 'memberage' parameter in /edit-family-member.php. A public exploit exists, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Employee Record Management System 1.3 allows remote authenticated attackers to manipulate the 'emp3workduration' parameter in /editmyexp.php, potentially leading to data exfiltration or modification. A public exploit is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.06%), indicating limited exploitation likelihood.
Cross-site request forgery in code-projects Traffic Offense Reporting System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. Publicly available exploit code exists, but no active exploitation has been confirmed. The low EPSS score (0.06%) suggests limited real-world risk.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or manipulate database contents via the itr_no parameter in /view_dental.php. Public exploit code is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.04%), indicating limited exploitation likelihood.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no or comp_id parameters in /birthing.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.04%).
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no parameter in view_hematology.php. A public exploit exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.04%), suggesting limited real-world risk.
SQL injection in Health Center Patient Record Management System 1.0 allows authenticated attackers to manipulate database queries via the itr_no parameter in /birthing_record.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.04%), indicating limited exploitation likelihood.
The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hk_dataset_results() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Stored cross-site scripting in iSoluçõesWEB up to 20250519 allows an authenticated attacker with low privileges to inject malicious scripts via the 'Descrição da solicitação' parameter in the /fluxos-dashboard endpoint. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.06%).
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows remote authenticated attackers to inject arbitrary web scripts via the 'Type' parameter in /data/insert_type.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows remote authenticated users to inject arbitrary web scripts via the 'Type' parameter in /data/edit_type.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Customer parameter in /data/edit_laundry.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Customer parameter in /data/insert_laundry.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Stored cross-site scripting in code-projects Traffic Offense Reporting System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via multiple parameters in /save-reported.php. Public exploit code exists, but EPSS score is low (0.05%) and no active exploitation has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Subject field on the Subjects page. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Class Name field on the Classes page. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported and the EPSS score is low (0.09%).
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Academic Term field in the Add Academic Term page. The vulnerability is publicly exploited with a proof-of-concept available, though EPSS score is low (0.09%) and no active exploitation in CISA KEV has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Title field on the Announcement page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Division parameter on the Division System page. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated high-privilege user to inject malicious scripts via the email field on the profile update page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).