Total
422082 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-1580 | 1 Freehtmldesigns | 1 Site Offline | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature. | |||||
| CVE-2022-1579 | 1 Gunkastudios | 1 Login Block Ips | 2026-06-17 | N/A | 7.5 HIGH |
| The function check_is_login_page() uses headers for the IP check, which can be easily spoofed. | |||||
| CVE-2022-1578 | 1 My Wpdb Project | 1 My Wpdb | 2026-06-17 | N/A | 8.8 HIGH |
| The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack | |||||
| CVE-2022-1577 | 1 Deliciousbrains | 1 Database Backup | 2026-06-17 | 5.8 MEDIUM | 5.4 MEDIUM |
| The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule | |||||
| CVE-2022-1576 | 1 Themeisle | 1 Wp Maintenance Mode \& Coming Soon | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack | |||||
| CVE-2022-1575 | 1 Diagrams | 1 Drawio | 2026-06-17 | 6.8 MEDIUM | 9.6 CRITICAL |
| Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app. | |||||
| CVE-2022-1574 | 1 Html2wp Project | 1 Html2wp | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server | |||||
| CVE-2022-1573 | 1 Html2wp Project | 1 Html2wp | 2026-06-17 | 4.3 MEDIUM | 4.3 MEDIUM |
| The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them | |||||
| CVE-2022-1572 | 1 Html2wp Project | 1 Html2wp | 2026-06-17 | 5.5 MEDIUM | 8.1 HIGH |
| The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file | |||||
| CVE-2022-1571 | 1 Facturascripts | 1 Facturascripts | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ... | |||||
| CVE-2022-1570 | 1 Files Download Delay Project | 1 Files Download Delay | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action. | |||||
| CVE-2022-1569 | 1 Pieforms | 1 Drag \& Drop Builder | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed | |||||
| CVE-2022-1568 | 1 Wpdarko | 1 Team Members | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | |||||
| CVE-2022-1567 | 1 Wp-js Project | 1 Wp-js | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6. | |||||
| CVE-2022-1566 | 1 Quotes Llama Project | 1 Quotes Llama | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file | |||||
| CVE-2022-1565 | 1 Wpallimport | 1 Wp All Import | 2026-06-17 | N/A | 7.2 HIGH |
| The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible. | |||||
| CVE-2022-1564 | 1 10web | 1 Form Maker | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | |||||
| CVE-2022-1563 | 1 Wpengine | 1 Wpgraphql | 2026-06-17 | N/A | 5.3 MEDIUM |
| The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL. | |||||
| CVE-2022-1562 | 1 Room 34 Creative Services | 1 Enable Svg | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads | |||||
| CVE-2022-1561 | 2 Krakend, Luraproject | 2 Krakend, Lura | 2026-06-17 | N/A | 4.0 MEDIUM |
| Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable. | |||||