Total
424621 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-2431 | 1 W3eden | 1 Download Manager | 2026-06-17 | N/A | 8.1 HIGH |
| The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server. | |||||
| CVE-2022-2430 | 1 Visualcomposer | 1 Visual Composer Website Builder | 2026-06-17 | N/A | 6.4 MEDIUM |
| The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2022-2429 | 1 Ultimatesmsnotifications | 1 Ultimate Sms Notifications For Woocommerce | 2026-06-17 | N/A | 6.5 MEDIUM |
| The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. | |||||
| CVE-2022-2428 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 6.4 MEDIUM |
| A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests | |||||
| CVE-2022-2426 | 1 Thinkific | 1 Thinkific Uploader | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators. | |||||
| CVE-2022-2425 | 1 Wp Ds Blog Map Project | 1 Wp Ds Blog Map | 2026-06-17 | N/A | 4.8 MEDIUM |
| The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-2424 | 1 Google Maps Anywhere Project | 1 Google Maps Anywhere | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-2423 | 1 Designwall | 1 Dw Promobar | 2026-06-17 | N/A | 4.8 MEDIUM |
| The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-2422 | 1 Feathersjs | 1 Feathers-sequelize | 2026-06-17 | N/A | 10.0 CRITICAL |
| Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used. | |||||
| CVE-2022-2421 | 1 Socket | 1 Socket.io-parser | 2026-06-17 | N/A | 10.0 CRITICAL |
| Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. | |||||
| CVE-2022-2420 | 1 Eveo | 1 Urve Web Manager | 2026-06-17 | N/A | 8.0 HIGH |
| A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2022-2419 | 1 Eveo | 1 Urve Web Manager | 2026-06-17 | N/A | 8.0 HIGH |
| A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2022-2418 | 1 Eveo | 1 Urve Web Manager | 2026-06-17 | N/A | 8.0 HIGH |
| A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2022-2417 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 6.2 MEDIUM |
| Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project. | |||||
| CVE-2022-2415 | 1 Google | 1 Chrome | 2026-06-17 | N/A | 8.8 HIGH |
| Heap buffer overflow in WebGL in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |||||
| CVE-2022-2414 | 1 Dogtagpki | 1 Dogtagpki | 2026-06-17 | N/A | 7.5 HIGH |
| Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. | |||||
| CVE-2022-2413 | 1 Simonpedge | 1 Slide Anything | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled. | |||||
| CVE-2022-2412 | 1 Better Tag Cloud Project | 1 Better Tag Cloud | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-2411 | 1 Auto More Tag Project | 1 Auto More Tag | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-2410 | 1 Mtouch Quiz Project | 1 Mtouch Quiz | 2026-06-17 | N/A | 4.8 MEDIUM |
| The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||