CVE-2025-6236 | Medium | 4.8 | 2025-07-10 | The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2025-6234 | Medium | 6.1 | 2025-07-10 | The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2025-46242 | High | 7.6 | 2025-04-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affect… |
CVE-2025-30844 | High | 7.1 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Watu Quiz watu allows Reflected XSS.This issue affect… |
CVE-2024-53792 | High | 8.5 | 2024-12-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affect… |
CVE-2024-50410 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue… |
CVE-2024-50409 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue… |
CVE-2024-50407 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Reflected XSS.This is… |
CVE-2024-50408 | High | 8.8 | 2024-10-28 | Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through <= 2… |
CVE-2024-37446 | Medium | 5.9 | 2024-07-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kiboko Labs Chained Quiz allows Stored XSS.This is… |
CVE-2024-3753 | Medium | 5.9 | 2024-07-13 | The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-2640 | Medium | 5.4 | 2024-07-12 | The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been autho… |
CVE-2024-0873 | Medium | 6.4 | 2024-04-09 | The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode in all versions up to, and includ… |
CVE-2024-0872 | Medium | 4.3 | 2024-04-09 | The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-userinfo shortcode… |
CVE-2023-47686 | Medium | 4.3 | 2023-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.2.2 versions. |
CVE-2023-4602 | Medium | 6.1 | 2023-11-15 | The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and including, 2.6.1.1… |
CVE-2023-30483 | High | 7.1 | 2023-08-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.9.2 versions. |
CVE-2023-0545 | Medium | 4.8 | 2023-06-05 | The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2015-10111 | Medium | 6.3 | 2023-06-04 | A vulnerability was found in Watu Quiz Plugin up to 2.6.7 on WordPress. It has been rated as critical. This issue affects the function watu_exams of the file c… |
CVE-2023-25031 | Medium | 5.9 | 2023-04-07 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1 versions. |
CVE-2023-25020 | High | 7.1 | 2023-04-07 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions. |
CVE-2023-25027 | Medium | 5.9 | 2023-04-07 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Chained Quiz plugin <= 1.3.2.5 versions. |
CVE-2023-25022 | Medium | 5.9 | 2023-04-07 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.8 versions. |
CVE-2023-25061 | Medium | 6.5 | 2023-04-07 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions. |
CVE-2023-24383 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Namaste! LMS plugin <= 2.5.9.1 versions. |
CVE-2023-0844 | Medium | 4.8 | 2023-03-13 | The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform… |
CVE-2023-0968 | Medium | 6.1 | 2023-03-03 | The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and 'date' parameters in versions up to, an… |
CVE-2023-0548 | Medium | 4.8 | 2023-02-27 | The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to per… |
CVE-2023-0543 | Medium | 4.8 | 2023-02-27 | The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege us… |
CVE-2023-0429 | Medium | 4.8 | 2023-02-21 | The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2023-0428 | Medium | 6.1 | 2023-02-21 | The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2022-4220 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-4219 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-4218 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-4217 | Medium | 5.5 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to… |
CVE-2022-4216 | Medium | 5.5 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2… |
CVE-2022-4215 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4214 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4213 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4212 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4211 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up… |
CVE-2022-4210 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4209 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up… |
CVE-2022-4208 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up t… |
CVE-2021-24690 | Medium | 5.4 | 2021-10-11 | The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings. |
CVE-2021-38358 | Medium | 6.1 | 2021-09-10 | The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file wh… |
CVE-2021-38317 | Medium | 6.1 | 2021-09-09 | The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscriptions.html.php fil… |
CVE-2018-14502 | Critical | 9.8 | 2020-03-10 | controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via… |
CVE-2020-7104 | Medium | 6.1 | 2020-01-17 | The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter. |
CVE-2015-9418 | Medium | 4.3 | 2019-09-26 | The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. |
CVE-2016-10892 | Medium | 6.1 | 2019-08-20 | The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues. |
CVE-2019-12345 | Medium | 6.1 | 2019-05-27 | XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress. |
CVE-2018-1002009 | Medium | 4.8 | 2018-12-03 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exp… |
CVE-2018-1002008 | Medium | 4.8 | 2018-12-03 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exp… |
CVE-2018-1002007 | Medium | 4.8 | 2018-12-03 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exp… |
CVE-2018-1002006 | Medium | 4.8 | 2018-12-03 | These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request var… |
CVE-2018-1002005 | Medium | 4.8 | 2018-12-03 | These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_signup_date parameter. |
CVE-2018-1002004 | Medium | 4.8 | 2018-12-03 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exp… |
CVE-2018-1002003 | Medium | 4.8 | 2018-12-03 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exp… |
CVE-2018-1002002 | Medium | 4.8 | 2018-12-03 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exp… |
CVE-2018-1002001 | Medium | 4.8 | 2018-12-03 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exp… |
CVE-2018-1002000 | High | 7.2 | 2018-12-03 | There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. The… |
CVE-2018-18461 | Critical | 9.8 | 2018-10-18 | The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code i… |