Total
425358 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-4119 | 1 Sirv | 1 Image Optimizer\, Resizer And Cdn | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-4118 | 1 Coinmarketstats | 1 Bitcoin \/ Altcoin Payment Gateway For Woocommerce | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users | |||||
| CVE-2022-4117 | 1 Iws-geo-form-fields Project | 1 Iws-geo-form-fields | 2026-06-17 | N/A | 9.8 CRITICAL |
| The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection. | |||||
| CVE-2022-4116 | 2 Quarkus, Redhat | 2 Quarkus, Build Of Quarkus | 2026-06-17 | N/A | 9.8 CRITICAL |
| A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution. | |||||
| CVE-2022-4115 | 1 Editorial Calendar Project | 1 Editorial Calendar | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users. | |||||
| CVE-2022-4114 | 1 Apusthemes | 1 Superio | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks. | |||||
| CVE-2022-4112 | 1 Vms-studio | 1 Quizlord | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-4111 | 1 Tooljet | 1 Tooljet | 2026-06-17 | N/A | 6.5 MEDIUM |
| Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB. | |||||
| CVE-2022-4110 | 1 Eventify Project | 1 Eventify | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-4109 | 1 Cedcommerce | 1 Wholesale Market For Woocommerce | 2026-06-17 | N/A | 2.7 LOW |
| The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite) | |||||
| CVE-2022-4108 | 1 Cedcommerce | 1 Wholesale Market For Woocommerce | 2026-06-17 | N/A | 4.9 MEDIUM |
| The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite) | |||||
| CVE-2022-4107 | 1 Cedcommerce | 1 Smsa Shipping For Woocommerce | 2026-06-17 | N/A | 6.5 MEDIUM |
| The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server | |||||
| CVE-2022-4106 | 1 Cedcommerce | 1 Wholesale Market For Woocommerce | 2026-06-17 | N/A | 7.5 HIGH |
| The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server. | |||||
| CVE-2022-4105 | 1 Kiwitcms | 1 Kiwi Tcms | 2026-06-17 | N/A | 5.4 MEDIUM |
| A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page. | |||||
| CVE-2022-4104 | 1 Lepton Project | 1 Lepton | 2026-06-17 | N/A | 5.5 MEDIUM |
| A loop with an unreachable exit condition can be triggered by passing a crafted JPEG file to the Lepton image compression tool, resulting in a denial-of-service. | |||||
| CVE-2022-4103 | 1 Royal-elementor-addons | 1 Royal Elementor Addons | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title | |||||
| CVE-2022-4102 | 1 Royal-elementor-addons | 1 Royal Elementor Addons | 2026-06-17 | N/A | 3.1 LOW |
| The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug. | |||||
| CVE-2022-4101 | 1 Images Optimize And Upload Cf7 Project | 1 Images Optimize And Upload Cf7 | 2026-06-17 | N/A | 9.1 CRITICAL |
| The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack. | |||||
| CVE-2022-4100 | 1 Wpcerber | 1 Cerber Security Antispam \& Malware Scan | 2026-06-17 | N/A | 5.3 MEDIUM |
| The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked. | |||||
| CVE-2022-4099 | 1 Getcloudsms | 1 Joy Of Text Lite | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection | |||||