CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9884 – T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
https://notcve.org/view.php?id=CVE-2024-9884
29 Oct 2024 — The T(-) Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento T(-) Countdown para WordPress es vulnerable a Cro... • https://plugins.trac.wordpress.org/browser/t-countdown/trunk/t-countdown.php#L810 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49847 – WordPress Annual Archive Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-49847
06 Dec 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue affects Annual Archive: from n/a through 1.6.0. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en Twinpictures Annual Archive permite almacenar XSS. Este problema afecta a Annual Archive: desde n/a hasta 1.6.0. The Annual Archive plugin for WordPress is vulnerable to Stored Cr... • https://patchstack.com/database/vulnerability/anual-archive/wordpress-annual-archive-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40669 – WordPress Collapse-O-Matic Plugin <= 1.8.5.5 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-40669
22 Aug 2023 — Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in twinpictures, baden03 Collapse-O-Matic plugin <= 1.8.5.5 versions. Vulnerabilidad de Coss-Site Scripting (XSS) autenticada (con permisos de colaboradores o superiores) almacenada en twinpictures, complemento baden03 Collapse-O-Matic en versiones <= 1.8.5.5. The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.5.5 due to insufficient input sanitization and output ... • https://patchstack.com/database/vulnerability/jquery-collapse-o-matic/wordpress-collapse-o-matic-plugin-1-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0178 – Annual Archive < 1.6.0 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-0178
12 Jan 2023 — The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The Annual Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user ... • https://wpscan.com/vulnerability/cc308e15-7937-4d41-809d-74f8c13bee23 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0171 – jQuery T(-) Countdown Widget < 2.3.24 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-0171
12 Jan 2023 — The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.3.23 due to insufficient input sanitizatio... • https://wpscan.com/vulnerability/32324655-ff91-4a53-a2c5-ebe6678d4a9d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4475 – Collapse-O-Matic < 1.8.3 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-4475
28 Dec 2022 — The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. El complemento Collapse-O-Matic de WordPress anterior a 1.8.3 no valida ni escapa algunos de sus atributos de código corto antes de devolverlos a la página, lo que podría permitir a los usu... • https://wpscan.com/vulnerability/3b5c377c-3148-4373-996c-89851d5e39e5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •