CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| MITTEL6.1 |
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
| 28/08/2019 |
| CVE-2015-9357 | MITTEL6.1 | The akismet plugin before 3.1.5 for WordPress has XSS. | 28/08/2019 |
| CVE-2016-10763 | MITTEL4.8 | The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body. | 18/07/2019 |
| CVE-2016-10762 | HOCH7.5 | The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. | 18/07/2019 |
| CVE-2016-10706 | MITTEL6.1 | The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. | 12/01/2018 |
| CVE-2016-10705 | MITTEL6.1 | The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. | 12/01/2018 |
| CVE-2017-17058 | HOCH7.5 | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defin | 29/11/2017 |
| CVE-2015-3429 | MITTEL4.3 | Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier. | 17/06/2015 |
| CVE-2014-0173 | MITTEL5.8 | The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, w | 22/04/2014 |