CVE-2025-52746 | High | 7.1 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ayecode Restaurante restaurante allows Reflected XSS.This… |
CVE-2025-6200 | Medium | 5.9 | 2025-07-11 | The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2025-24673 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored… |
CVE-2024-13590 | Medium | 6.4 | 2025-01-22 | The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and includi… |
CVE-2024-56259 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This is… |
CVE-2024-43981 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2024-43973 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Get… |
CVE-2024-50437 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This is… |
CVE-2024-43145 | High | 8.5 | 2024-08-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory… |
CVE-2024-6477 | High | 7.5 | 2024-08-03 | The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to downloa… |
CVE-2024-6265 | Critical | 9.8 | 2024-06-29 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based S… |
CVE-2024-3732 | Medium | 6.4 | 2024-04-23 | The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… |
CVE-2024-2423 | Medium | 6.4 | 2024-04-09 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross… |
CVE-2023-50845 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirecto… |
CVE-2022-47442 | Medium | 5.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9. |
CVE-2023-2813 | Medium | 6.1 | 2023-09-04 | All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1… |
CVE-2022-4775 | Medium | 5.4 | 2023-01-23 | The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-29453 | Medium | 5.4 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update. |
CVE-2022-0442 | Medium | 4.3 | 2022-03-07 | The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are uniq… |
CVE-2021-24720 | Medium | 5.4 | 2021-10-11 | The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS). |
CVE-2021-24369 | Medium | 5.4 | 2021-06-21 | In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fi… |
CVE-2021-24361 | Critical | 9.8 | 2021-06-21 | In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST param… |