Total
425000 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-4684 | 1 Usememos | 1 Memos | 2026-06-17 | N/A | 8.8 HIGH |
| Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. | |||||
| CVE-2022-4683 | 1 Usememos | 1 Memos | 2026-06-17 | N/A | 6.5 MEDIUM |
| Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. | |||||
| CVE-2022-4682 | 1 Wpgogo | 1 Lightbox-gallery | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2022-4681 | 1 Wpwave | 1 Hide My Wp | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | |||||
| CVE-2022-4680 | 1 Revive | 1 Revive Old Posts | 2026-06-17 | N/A | 7.2 HIGH |
| The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. | |||||
| CVE-2022-4679 | 1 Wufoo | 1 Shortcode | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2022-4678 | 1 Templatesnext | 1 Templatesnext Toolkit | 2026-06-17 | N/A | 5.4 MEDIUM |
| The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2022-4677 | 1 Mapsmarker | 1 Leaflet Maps Marker | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | |||||
| CVE-2022-4676 | 1 Openstreetmap | 1 Openstreetmap | 2026-06-17 | N/A | 5.4 MEDIUM |
| The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | |||||
| CVE-2022-4675 | 1 Mongoosemarketplace | 1 Mongoose Page Plugin | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | |||||
| CVE-2022-4674 | 1 Vowelweb | 1 Ibtana | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack | |||||
| CVE-2022-4673 | 1 Blazzdev | 1 Rate My Post | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | |||||
| CVE-2022-4672 | 1 Tipsandtricks-hq | 1 Wordpress Simple Paypal Shopping Cart | 2026-06-17 | N/A | 5.4 MEDIUM |
| The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4671 | 1 Pixelgrade | 1 Pixcodes | 2026-06-17 | N/A | 5.4 MEDIUM |
| The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4670 | 1 Pdf.js Viewer Project | 1 Pdf.js Viewer | 2026-06-17 | N/A | 5.4 MEDIUM |
| The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2022-4669 | 1 Blueastral | 1 Page Builder\ | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2022-4668 | 1 Easy-appointments | 1 Easy Appointments | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4667 | 1 Themeisle | 1 Rss Aggregator By Feedzy | 2026-06-17 | N/A | 5.4 MEDIUM |
| The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4666 | 1 Terakoya | 1 Markup \(json-ld\) Structured In Schema.org | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2022-4665 | 1 Ampache | 1 Ampache | 2026-06-17 | N/A | 8.8 HIGH |
| Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6. | |||||