Total
47481 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-1546 | 1 Visser | 1 Woocommerce - Product Importer | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-1542 | 1 Justsystems | 1 Hpb Dashboard | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. | |||||
| CVE-2022-1541 | 1 Richweb | 1 Video Slider | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | |||||
| CVE-2022-1536 | 1 Automad | 1 Automad | 2026-06-17 | 3.5 LOW | 3.5 LOW |
| A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home</title><script>alert("home")</script><title> leads to a cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit details have disclosed to the public and may be used. | |||||
| CVE-2022-1532 | 1 Themify | 1 Woocommerce Product Filter | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-1530 | 1 Livehelperchat | 1 Live Helper Chat | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application. | |||||
| CVE-2022-1528 | 1 Vikwp | 1 Vik Booking | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-1527 | 1 Wpwhitesecurity | 1 Wp 2fa | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-1526 | 1 Emlog | 1 Emlog | 2026-06-17 | 3.5 LOW | 3.5 LOW |
| A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiate the attack remotely but it requires a signup and login by the attacker. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2022-1514 | 1 Facturascripts | 1 Facturascripts | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account. | |||||
| CVE-2022-1512 | 1 Scrollrevealjs-effects Project | 1 Scrollrevealjs-effects | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | |||||
| CVE-2022-1506 | 1 Wp Born Babies Project | 1 Wp Born Babies | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks | |||||
| CVE-2022-1504 | 1 Microweber | 1 Microweber | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks. | |||||
| CVE-2022-1503 | 1 Get-simple | 1 Getsimple Cms | 2026-06-17 | 3.5 LOW | 3.5 LOW |
| A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like <script>alert(1)</script> leads to cross site scripting. The attack may be launched remotely but requires authentication. Expoit details have been disclosed within the advisory. | |||||
| CVE-2022-1494 | 1 Google | 1 Chrome | 2026-06-17 | N/A | 6.1 MEDIUM |
| Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page. | |||||
| CVE-2022-1492 | 1 Google | 1 Chrome | 2026-06-17 | N/A | 6.1 MEDIUM |
| Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page. | |||||
| CVE-2022-1474 | 1 Wp-eventmanager | 1 Wp Event Manager | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-1470 | 1 Ultimate Woocommerce Csv Importer Project | 1 Ultimate Woocommerce Csv Importer | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-1469 | 1 Fibosearch | 1 Fibosearch | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed | |||||
| CVE-2022-1465 | 1 Wpclever | 1 Wpc Smart Wishlist For Woocommerce | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue. | |||||