Total
424621 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-2388 | 1 Wow-company | 1 Wp Coder | 2026-06-17 | N/A | 6.5 MEDIUM |
| The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack | |||||
| CVE-2022-2387 | 1 Awesomemotive | 1 Easy Digital Downloads | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack | |||||
| CVE-2022-2386 | 1 Automattic | 1 Crowdsignal Dashboard | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-2385 | 1 Kubernetes | 1 Aws-iam-authenticator | 2026-06-17 | 6.0 MEDIUM | 8.1 HIGH |
| A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges. | |||||
| CVE-2022-2384 | 1 Supsystic | 1 Digital Publications By Supsystic | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2022-2383 | 1 Slickremix | 1 Feed Them Social | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-2382 | 1 Shapedplugin | 1 Product Slider For Woocommerce | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options. | |||||
| CVE-2022-2381 | 1 E Unlocked - Student Result Project | 1 E Unlocked - Student Result | 2026-06-17 | N/A | 8.8 HIGH |
| The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to make a logged in admin upload arbitrary files, such as PHP via a CSRF attack | |||||
| CVE-2022-2380 | 1 Linux | 1 Linux Kernel | 2026-06-17 | N/A | 5.5 MEDIUM |
| The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel. | |||||
| CVE-2022-2379 | 1 Easy Student Results Project | 1 Easy Student Results | 2026-06-17 | N/A | 7.5 HIGH |
| The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such as email address, physical address, phone number etc | |||||
| CVE-2022-2378 | 1 Easy Student Results Project | 1 Easy Student Results | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-2377 | 1 Wpwax | 1 Directorist | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog | |||||
| CVE-2022-2376 | 1 Wpwax | 1 Directorist | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users | |||||
| CVE-2022-2375 | 1 Okapitech | 1 Wp Sticky Button | 2026-06-17 | N/A | 5.4 MEDIUM |
| The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues | |||||
| CVE-2022-2374 | 1 Nsqua | 1 Simply Schedule Appointments | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-2373 | 1 Nsqua | 1 Simply Schedule Appointments | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address | |||||
| CVE-2022-2372 | 1 Yaycommerce | 1 Yaysmtp | 2026-06-17 | N/A | 4.8 MEDIUM |
| The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-2371 | 1 Yaycommerce | 1 Yaysmtp | 2026-06-17 | N/A | 5.4 MEDIUM |
| The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well. | |||||
| CVE-2022-2370 | 1 Yaycommerce | 1 Yaysmtp | 2026-06-17 | N/A | 6.5 MEDIUM |
| The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them | |||||
| CVE-2022-2369 | 1 Yaycommerce | 1 Yaysmtp | 2026-06-17 | N/A | 4.3 MEDIUM |
| The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin | |||||