CVE-2025-46240 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counte… |
CVE-2025-46239 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS… |
CVE-2024-5002 | Medium | 4.8 | 2024-07-13 | The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-0979 | Medium | 6.1 | 2024-06-13 | The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including… |
CVE-2024-2470 | Medium | 5.4 | 2024-06-04 | The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-1983 | High | 7.1 | 2024-03-20 | The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsani… |
CVE-2023-45603 | Critical | 9.0 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue a… |
CVE-2023-49743 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This… |
CVE-2023-5614 | Medium | 6.4 | 2023-10-20 | The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all versions up to, and… |
CVE-2023-4838 | Medium | 6.4 | 2023-09-09 | The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.6… |
CVE-2023-4779 | Medium | 6.4 | 2023-09-06 | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and incl… |
CVE-2023-4308 | High | 7.2 | 2023-08-15 | The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and in… |
CVE-2019-25138 | Critical | 9.8 | 2023-06-07 | The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in v… |
CVE-2023-26517 | Medium | 5.9 | 2023-05-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeff Starr Dashboard Widgets Suite plugin <= 3.2.1 versions. |
CVE-2022-27850 | Medium | 5.4 | 2022-04-15 | Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message. |
CVE-2022-27849 | Medium | 5.3 | 2022-04-15 | Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115 |
CVE-2022-1165 | Critical | 9.1 | 2022-04-04 | The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting t… |
CVE-2022-25610 | Low | 3.4 | 2022-03-25 | Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires… |
CVE-2022-25601 | Medium | 4.7 | 2022-03-11 | Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4). |
CVE-2021-24409 | Medium | 6.1 | 2021-07-12 | The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site… |
CVE-2021-24408 | Medium | 5.4 | 2021-07-12 | The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to s… |
CVE-2016-11001 | Medium | 6.1 | 2019-09-20 | The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. |