Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Wpbeginner Clear all filters
TI-2025-04738 CVE-2025-5275 · GHSA-jj56-99pp-w4hp

Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings

Priority LOW 20

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and in…

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00206 Published 2025-06-26 No fix listed CWE-79
TI-2025-04090 CVE-2025-4577 · GHSA-h8v5-mvp3-hf33

Cross-site scripting in smub Smash Balloon Social Post Feed – Simple Social Feeds for…

Priority LOW 28

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-color attribute in all versions up to, and including, 4.3.1 due to ins…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00343 Published 2025-06-10 No fix listed CWE-79
TI-2024-10084 CVE-2024-10878 · GHSA-hr7p-jmcg-rv72

Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting

Priority LOW 28

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00482 Published 2024-11-26 No fix listed CWE-79
TI-2024-09321 CVE-2024-10045 · GHSA-4x48-m5rh-j93w

Transients Manager <= 2.0.6 - Cross-Site Request Forgery

Priority LOW 19

The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00226 Published 2024-10-23 No fix listed CWE-352
TI-2015-04653 CVE-2015-5528 · GHSA-3v56-f4jg-q96g

Cross-site scripting (XSS) vulnerability in the save_order function in…

Priority LOW 24

Cross-site scripting (XSS) vulnerability in the save_order function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02053 Published 2015-07-16 No fix listed CWE-79