Vulnerabilities

Filters

Reset all

1 selected

25 records

Sort

Vendor: Fullworks Clear all filters

TI-2026-75194 CVE-2026-110017 · GHSA-q8wf-34g4-mm3w

Stored cross-site scripting in Quick PayPal Payments WordPress plugin

LOW 28

The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitizati…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00195 Published 2026-10-16 No fix listed CWE-79

TI-2026-71613 CVE-2026-108492 · GHSA-xxg6-q3fq-9xq2

WordPress Quick Paypal Payments plugin missing authorization

LOW 29

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00178 Published 2026-10-13 No fix listed CWE-862

TI-2024-12404 CVE-2024-13362 · GHSA-c7cj-88jr-mhx2

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

LOW 27

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00276 Published 2026-05-01 No fix listed CWE-79

TI-2026-28509 CVE-2026-39535 · GHSA-42vq-c86x-66jp

WordPress Display Eventbrite Events plugin <= 6.5.6 - Broken Access Control vulnerability

LOW 29

Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: f…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00198 Published 2026-04-08 No fix listed CWE-862

TI-2025-19874 CVE-2025-27003 · GHSA-h2v2-p339-m97g

WordPress Quick Paypal Payments Plugin <= 5.7.46 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in fullworks Quick Paypal Payments quick-paypal-payments allows Cross Site Request Forgery.This issue affects Quick Paypal Payments: from n/a through <= 5.7.46.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00128 Published 2025-09-05 No fix listed CWE-352

TI-2025-03831 CVE-2025-4302 · GHSA-498r-64c2-wwrm

Stop User Enumeration < 1.7.3 - Protection Bypass

MEDIUM 63

The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00984 Published 2025-07-17 Fixed in 1.7.3

TI-2025-30007 CVE-2025-47510 · GHSA-7rqx-j7hv-hqhq

WordPress Display Eventbrite Events plugin < 6.3 - Local File Inclusion Vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows PHP Local File Inclusion.This…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00778 Published 2025-05-07 No fix listed CWE-98

TI-2023-09762 CVE-2023-23975 · GHSA-mhgc-69vw-rqc7

WordPress Quick Event Manager plugin <= 9.7.4 - Broken Access Control vulnerability

LOW 31

Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Event Manager: from n/a through 9.7.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00658 Published 2024-12-09 No fix listed CWE-862

TI-2023-10508 CVE-2023-25035 · GHSA-rpfq-4x8m-967r

WordPress Quick Contact Form plugin <= 8.0.3.1 - Broken Access Control vulnerability

LOW 36

Missing Authorization vulnerability in Fullworks Quick Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Contact Form : from n/a through 8.0.3.1.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00714 Published 2024-12-09 No fix listed CWE-862

TI-2023-10990 CVE-2023-25714 · GHSA-72cj-44mg-7gv5

WordPress Quick Paypal Payments plugin <= 5.7.25 - Broken Access Control vulnerability

MEDIUM 40

Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00764 Published 2024-12-09 No fix listed CWE-862

TI-2024-09843 CVE-2024-10621 · GHSA-3pxf-7374-v7cp

Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 28

The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00345 Published 2024-11-08 No fix listed CWE-80

TI-2022-04562 CVE-2022-4974 · GHSA-p5fp-r7v7-h5q7

Freemius SDK <= 2.4.2 - Missing Authorization Checks

LOW 28

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_de…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00442 Published 2024-10-16 Fixed in 2.0.2, 1.9.8 +273 CWE-862

TI-2023-01466 CVE-2023-1554 · GHSA-8cf9-r9vq-j85q

Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS

MEDIUM 55

The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0047 Published 2023-05-02 Fixed in 5.7.26.4 CWE-79

TI-2023-09688 CVE-2023-23889 · GHSA-g7w9-8ww6-vhhw

WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00361 Published 2023-04-25 No fix listed CWE-79

TI-2022-23646 CVE-2022-47608 · GHSA-29wx-wghr-g778

WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-04-25 No fix listed CWE-79

TI-2023-10989 CVE-2023-25713 · GHSA-8c29-7v4v-jmh4

WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00406 Published 2023-04-07 No fix listed CWE-79

TI-2023-10978 CVE-2023-25702 · GHSA-54hc-hc4h-876h

WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00392 Published 2023-04-07 No fix listed CWE-79

TI-2023-09684 CVE-2023-23885 · GHSA-c49g-4rj2-vxxp

WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00386 Published 2023-04-07 No fix listed CWE-79

TI-2023-09766 CVE-2023-23979 · GHSA-734q-pq52-4w9r

WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00406 Published 2023-04-06 No fix listed CWE-79

TI-2022-23207 CVE-2022-46863 · GHSA-7pwg-6h7v-4x3q

WordPress Quick Event Manager Plugin <= 9.6.4 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.6.4 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-03-28 No fix listed CWE-79

TI-2023-09761 CVE-2023-23974 · GHSA-v6rp-x972-g5w7

WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 24

Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update).

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00234 Published 2023-03-01 No fix listed CWE-352

TI-2023-09326 CVE-2023-23491 · GHSA-8vf4-cp85-x9v7

Cross-site scripting in Quick Event Manager WordPress Plugin

HIGH 68

The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01191 Published 2023-01-20 Fixed in 9.7.5 CWE-79

TI-2022-17413 CVE-2022-37339 · GHSA-5rr9-5h6r-5qx9

WordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

LOW 25

Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00524 Published 2022-09-23 No fix listed CWE-79

TI-2017-13709 CVE-2017-18536 · GHSA-89h9-hfwf-446p

The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.

LOW 31

The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0203 Published 2019-08-21 No fix listed CWE-79

TI-2017-14542 CVE-2017-1000226 · GHSA-4936-wqj9-mmwh

Stop User Enumeration 1.3.8 allows user enumeration via the REST API

LOW 27

Stop User Enumeration 1.3.8 allows user enumeration via the REST API

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01385 Published 2017-11-17 No fix listed CWE-200