Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.Oct 14, 2026
- Medium4.9The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parame…EPSS 0.2%Oct 14, 2026
- Medium6.4The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_image…EPSS 0.3%Oct 14, 2026
- Medium6.4The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title…EPSS 0.3%Oct 14, 2026
- Medium6.4The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insuffi…EPSS 0.3%Oct 14, 2026
- High8.8The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in th…EPSS 0.2%Oct 14, 2026
- Medium6.8The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users wit…EPSS 0.2%Oct 14, 2026
- Medium6.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline scrip…EPSS 0.2%Oct 14, 2026
- High8.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an…EPSS 0.2%Oct 14, 2026
- Medium6.8The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe H…EPSS 0.2%Oct 14, 2026
- Medium6.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline scr…EPSS 0.2%Oct 14, 2026
- Medium6.4The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versio…EPSS 0.3%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plu…EPSS 0.3%Oct 14, 2026
- High7.2The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and includin…EPSS 0.3%Oct 14, 2026
- High7.2The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and includ…EPSS 0.4%Oct 14, 2026
- Medium6.4The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to,…EPSS 0.2%Oct 14, 2026
- Medium4.7The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to…EPSS 0.2%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including,…EPSS 0.3%Oct 14, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploadi…EPSS 0.2%Oct 13, 2026
- Medium5.4Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability.EPSS 0.4%Oct 13, 2026
- Medium5.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts…EPSS 0.4%Oct 13, 2026
- Medium5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.EPSS 0.3%Oct 13, 2026
- Medium5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.EPSS 0.3%Oct 13, 2026
- Medium5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.EPSS 0.3%Oct 13, 2026