Total
47481 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-1991 | 1 Fast Food Ordering System Project | 1 Fast Food Ordering System | 2026-06-17 | 3.5 LOW | 3.5 LOW |
| A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master List. The manipulation of the argument Description with the input foo "><img src="" onerror="alert(document.cookie)"> leads to cross site scripting. It is possible to launch the attack remotely but it requires authentication. Exploit details have been disclosed to the public. | |||||
| CVE-2022-1990 | 1 Kylephillips | 1 Nested Pages | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered_html is disallowed | |||||
| CVE-2022-1988 | 1 Facturascripts | 1 Facturascripts | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09. | |||||
| CVE-2022-1985 | 1 W3eden | 1 Download Manager | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file. | |||||
| CVE-2022-1980 | 1 Product Show Room Site Project | 1 Product Show Room Site | 2026-06-17 | 3.5 LOW | 2.4 LOW |
| A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/contact_info. The manipulation of the textbox Telephone with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but requires authentication. Exploit details have been disclosed to the public. | |||||
| CVE-2022-1979 | 1 Product Show Room Site Project | 1 Product Show Room Site | 2026-06-17 | 3.5 LOW | 3.5 LOW |
| A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires authentication. Exploit details have been disclosed to the public. | |||||
| CVE-2022-1971 | 1 Wpgetready | 1 Nextcellent Gallery | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-1964 | 1 Easy Svg Support Project | 1 Easy Svg Support | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads | |||||
| CVE-2022-1961 | 1 Gtm4wp | 1 Google Tag Manager | 2026-06-17 | 3.5 LOW | 5.5 MEDIUM |
| The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. | |||||
| CVE-2022-1951 | 1 Kitestudio | 1 Core Plugin For Kitestudio Themes | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting. | |||||
| CVE-2022-1948 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 8.7 HIGH |
| An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details. | |||||
| CVE-2022-1946 | 1 Wpdevart | 1 Gallery | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue | |||||
| CVE-2022-1945 | 1 Colorlib | 1 Coming Soon \& Maintenance Mode | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup) | |||||
| CVE-2022-1940 | 1 Gitlab | 1 Gitlab | 2026-06-17 | 3.5 LOW | 7.7 HIGH |
| A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues | |||||
| CVE-2022-1938 | 1 Awin | 1 Awin Data Feed | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged in admin viewing the plugin's settings | |||||
| CVE-2022-1937 | 1 Awin | 1 Awin Data Feed | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-1933 | 1 Collect And Deliver Interface For Woocommerce Project | 1 Collect And Deliver Interface For Woocommerce | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-1932 | 1 Rezgo | 1 Rezgo Online Booking | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file | |||||
| CVE-2022-1928 | 1 Gitea | 1 Gitea | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9. | |||||
| CVE-2022-1916 | 1 Pluginus | 1 Woot | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting | |||||