Vulnerabilities

TI-2026-04158 CVE-2026-4766 · GHSA-vg45-x5mp-5g9c

Easy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta

LOW 28

The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00194 Published 2026-03-25 No fix listed CWE-79

TI-2025-09077 CVE-2025-9892 · GHSA-jgqg-w357-v8wc

Restrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Update

LOW 23

The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00147 Published 2025-10-03 No fix listed CWE-352

TI-2025-02210 CVE-2025-2540 · GHSA-gvq2-qm4m-332c

Cross-site scripting in nayon46 Awesome Wp Image Gallery

LOW 28

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions due to insufficient input sanitization and output escaping on…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0034 Published 2025-07-03 No fix listed CWE-79

TI-2025-23720 CVE-2025-32655 · GHSA-cjhq-hwgq-r969

WordPress Restrict User Registration plugin <= 1.0.1 - CSRF to Stored XSS vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in DevriX Restrict User Registration restrict-user-registration allows Stored XSS.This issue affects Restrict User Registration: from n/a through <= 1.0.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00152 Published 2025-04-17 No fix listed CWE-352

TI-2025-20874 CVE-2025-28931 · GHSA-vxg2-q7pw-5mpg

WordPress WordPress Hashtags plugin <= 0.3.2 - CSRF to Stored XSS vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in DevriX Hashtags wp-hashtags allows Stored XSS.This issue affects Hashtags: from n/a through <= 0.3.2.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00151 Published 2025-03-11 No fix listed CWE-352

TI-2025-17342 CVE-2025-23575 · GHSA-pc4g-h6r6-mq33

WordPress DX Sales CRM plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 33

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevriX DX Sales CRM dx-sales-crm allows Reflected XSS.This issue affects DX Sales CRM: from n/a through <= 1.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0037 Published 2025-03-03 No fix listed CWE-79

TI-2024-36425 CVE-2024-54337 · GHSA-89r2-hwx6-33p8

WordPress DX Dark Site plugin <= 1.0.1 - CSRF to Stored Cross-Site Scripting vulnerability

LOW 31

Cross-Site Request Forgery (CSRF) vulnerability in DevriX DX Dark Site devrix-dark-site allows Stored XSS.This issue affects DX Dark Site: from n/a through <= 1.0.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00196 Published 2024-12-13 No fix listed CWE-352

TI-2022-01856 CVE-2022-2001 · GHSA-crr5-mf4p-x3rf

DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting

MEDIUM 41

The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00649 Published 2022-07-18 No fix listed CWE-352

Vulnerabilities

Filters