Vulnerabilities protected by our XSS: Cross Site Scripting firewall rule

32,890,858
Attacks Blocked in Past 24 Hours

Showing 1-20 of 6,158 Vulnerabilities

EventON <= 2.1.7 - Authenticated (Admin+) HTML Injection
3.0
CVE-2023-6046
Nov 9, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
Photo Gallery by 10Web <= 1.1.30 - Reflected Cross-Site Scripting
3.1
CVE-2014-6315
Oct 1, 2014
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
WooCommerce Shipping Label <= 2.3.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
3.3
CVE-2024-32834
Apr 22, 2024
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
authLdap <= 2.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
3.3
CVE-2023-41655
Sep 1, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
breadcrumb simple <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
3.3
CVE-2023-35092
Jun 15, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
UTM Tracker <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
3.3
CVE-2023-23822
May 24, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Baidu Tongji generator <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
3.3
CVE-2023-31233
May 18, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Block Referer Spam <= 1.1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
3.3
CVE-2023-32497
May 9, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
iThemes Security < 5.3.5 - Authenticated Cross-Site Scripting
3.3
CVE ID Unknown
Apr 5, 2016
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin) <= 1.6 - Cross-Site Scripting
3.4
CVE-2021-36889
Dec 17, 2021
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) <= 5.1.2 - Cross-Site Scripting
3.5
CVE-2014-9174
Nov 26, 2014
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
wp2syslog <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
3.8
CVE-2023-25974
Feb 21, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
DupeOff <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
3.8
CVE-2023-26529
Feb 13, 2023
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Enable SVG, WebP & ICO Upload <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
3.8
CVE-2022-36343
Aug 1, 2022
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Image Gallery – Grid Gallery <= 1.1.1 - Stored Cross-Site Scripting
3.8
CVE-2022-1327
Jun 3, 2022
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
WP YouTube Lyte <= 1.7.15 - Authenticated (Admin+) Cross-Site Scripting
3.8
CVE-2021-24419
May 3, 2021
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
MonsterInsights - Google Analytics Dashboard for WordPress <= 5.4.4 - Authenticated Stored Cross-Site Scripting
3.8
CVE ID Unknown
Aug 10, 2015
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL
3.8
CVE-2014-5240
Aug 6, 2014
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting
4.0
CVE-2023-1159
Jun 1, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
Opal Hotel Room Booking plugin <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
4.1
CVE-2022-29449
May 17, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Title CVE ID CVSS Vector Date
EventON <= 2.1.7 - Authenticated (Admin+) HTML Injection CVE-2023-6046 3.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N November 9, 2023
Photo Gallery by 10Web <= 1.1.30 - Reflected Cross-Site Scripting CVE-2014-6315 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N October 1, 2014
WooCommerce Shipping Label <= 2.3.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting CVE-2024-32834 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N April 22, 2024
authLdap <= 2.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-41655 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N September 1, 2023
breadcrumb simple <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-35092 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N June 15, 2023
UTM Tracker <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-23822 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N May 24, 2023
Baidu Tongji generator <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-31233 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N May 18, 2023
Block Referer Spam <= 1.1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-32497 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N May 9, 2023
iThemes Security < 5.3.5 - Authenticated Cross-Site Scripting 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N April 5, 2016
tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin) <= 1.6 - Cross-Site Scripting CVE-2021-36889 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N December 17, 2021
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) <= 5.1.2 - Cross-Site Scripting CVE-2014-9174 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N November 26, 2014
wp2syslog <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-25974 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N February 21, 2023
DupeOff <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-26529 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N February 13, 2023
Enable SVG, WebP & ICO Upload <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2022-36343 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N August 1, 2022
Image Gallery – Grid Gallery <= 1.1.1 - Stored Cross-Site Scripting CVE-2022-1327 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N June 3, 2022
WP YouTube Lyte <= 1.7.15 - Authenticated (Admin+) Cross-Site Scripting CVE-2021-24419 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N May 3, 2021
MonsterInsights - Google Analytics Dashboard for WordPress <= 5.4.4 - Authenticated Stored Cross-Site Scripting 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N August 10, 2015
WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL CVE-2014-5240 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N August 6, 2014
Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-1159 4.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N June 1, 2023
Opal Hotel Room Booking plugin <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2022-29449 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N May 17, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation