Total
425020 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-4464 | 1 Themify | 1 Portfolio Post | 2026-06-17 | N/A | 5.4 MEDIUM |
| Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin. | |||||
| CVE-2022-4462 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 5.0 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response. | |||||
| CVE-2022-4460 | 1 Codelights-shortcodes-and-widgets Project | 1 Codelights-shortcodes-and-widgets | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins. | |||||
| CVE-2022-4459 | 1 Wp Show Posts Project | 1 Wp Show Posts | 2026-06-17 | N/A | 5.4 MEDIUM |
| The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4458 | 1 Amr Shortcode Any Widget Project | 1 Amr Shortcode Any Widget | 2026-06-17 | N/A | 5.4 MEDIUM |
| The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4457 | 1 Cloudflare | 1 Warp | 2026-06-17 | N/A | 5.5 MEDIUM |
| Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's device. | |||||
| CVE-2022-4456 | 1 Fallingfruit | 1 Falling-fruit | 2026-06-17 | N/A | 3.5 LOW |
| A vulnerability has been found in falling-fruit and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 15adb8e1ea1f1c3e3d152fc266071f621ef0c621. It is recommended to apply a patch to fix this issue. VDB-215446 is the identifier assigned to this vulnerability. | |||||
| CVE-2022-4455 | 1 Php-calendar | 1 Php-calendar | 2026-06-17 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue. | |||||
| CVE-2022-4454 | 1 M0ver | 1 Bible-online | 2026-06-17 | N/A | 5.5 MEDIUM |
| A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the file src/main/java/custom/application/search.java of the component Search Handler. The manipulation leads to sql injection. The name of the patch is 6ef0aabfb2d4ccd53fcaa9707781303af357410e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215444. | |||||
| CVE-2022-4453 | 1 3dflipbook | 1 3d Flipbook | 2026-06-17 | N/A | 5.4 MEDIUM |
| The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators. | |||||
| CVE-2022-4452 | 1 Google | 1 Chrome | 2026-06-17 | N/A | 8.8 HIGH |
| Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2022-4451 | 1 Heateor | 1 Sassy Social Share | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4449 | 1 Page Scroll To Id Project | 1 Page Scroll To Id | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | |||||
| CVE-2022-4448 | 1 Givewp | 1 Givewp | 2026-06-17 | N/A | 5.4 MEDIUM |
| The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2022-4447 | 1 Fontsy Project | 1 Fontsy | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | |||||
| CVE-2022-4446 | 1 Corebos | 1 Corebos | 2026-06-17 | N/A | 9.8 CRITICAL |
| PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0. | |||||
| CVE-2022-4445 | 1 Armandofiore | 1 Fl3r Feelbox | 2026-06-17 | N/A | 9.8 CRITICAL |
| The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | |||||
| CVE-2022-4444 | 1 Ipti | 1 Tag | 2026-06-17 | N/A | 3.5 LOW |
| A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.13.0 is able to address this issue. The name of the patch is 7e311be22d3a0a1b53e61cb987ba13d681d85f06. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215431. | |||||
| CVE-2022-4443 | 1 Brutebank | 1 Brutebank | 2026-06-17 | N/A | 6.5 MEDIUM |
| The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. | |||||
| CVE-2022-4442 | 1 Cozmoslabs | 1 Custom Post Types And Custom Fields Creator | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). | |||||