Overview 54 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
54matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
1public PoC1.9%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
54
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
54
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
1.9%
Proof of concept only
3
5.6%
Forecast only
0
0.0%
No public exploit
50
92.6%
split by
peak 12 / year
20082
Not applicable2
Medium2
not blocked2
No public exploit2
20091
Not applicable1
Medium1
not blocked1
No public exploit1
20100
20111
Not applicable1
Medium1
not blocked1
Working exploit published1
20120
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20150
20160
20170
20181
Not applicable1
Medium1
not blocked1
No public exploit1
20193
Not applicable3
Medium3
not blocked3
No public exploit3
20200
20219
Not applicable9
Medium9
not blocked9
No public exploit9
202211
Not applicable11
Medium11
not blocked11
Proof of concept only2
No public exploit9
20239
Not applicable9
Medium9
not blocked9
No public exploit9
202412
Not applicable12
Medium12
not blocked12
No public exploit12
20253
Not applicable3
Medium3
not blocked3
Proof of concept only1
No public exploit2
200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-64380 | Medium | 2025-11-13 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Stored XSS.This issue affects Booster for WooCommerce: from n/a through <= 7.3.2. |
| CVE-2025-64379 | Medium | 2025-11-13 | Not applicable | No public exploit | Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through <= 7.4.0. |
| CVE-2024-10076 | Medium | 2025-05-15 | Not applicable | Proof of concept only | The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks |
| CVE-2024-9170 | Medium | 2024-11-26 | Not applicable | No public exploit | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcj_product_meta shortcode in all versions up to, and including, 7.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with ShopManager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-9239 | Medium | 2024-11-20 | Not applicable | No public exploit | The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-9066 | Medium | 2024-10-10 | Not applicable | No public exploit | The Marketing and SEO Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. |
| CVE-2023-52232 | Medium | 2024-06-09 | Not applicable | No public exploit | Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2. |
| CVE-2023-52230 | Medium | 2024-06-09 | Not applicable | No public exploit | Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.3. |
| CVE-2024-4788 | Medium | 2024-06-06 | Not applicable | No public exploit | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_bhf_post function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages or posts with arbitrary content. |
| CVE-2024-5006 | Medium | 2024-06-05 | Not applicable | No public exploit | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2023-51511 | Medium | 2024-06-04 | Not applicable | No public exploit | Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.3. |
| CVE-2023-52234 | Medium | 2024-03-28 | Not applicable | No public exploit | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.2. |
| CVE-2023-52231 | Medium | 2024-03-28 | Not applicable | No public exploit | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2. |
| CVE-2024-1534 | Medium | 2024-03-07 | Not applicable | No public exploit | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-1054 | Medium | 2024-02-29 | Not applicable | No public exploit | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wcj_product_barcode' shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'color'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2023-35883 | Medium | 2023-12-19 | Not applicable | No public exploit | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12. |
| CVE-2023-48333 | Medium | 2023-11-30 | Not applicable | No public exploit | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: from n/a through 7.1.1. |
| CVE-2023-40002 | Medium | 2023-11-23 | Not applicable | No public exploit | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions. |
| CVE-2023-4796 | Medium | 2023-10-20 | Not applicable | No public exploit | The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options. |
| CVE-2023-5638 | Medium | 2023-10-19 | Not applicable | No public exploit | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2023-4945 | Medium | 2023-09-14 | Not applicable | No public exploit | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2023-25044 | Medium | 2023-09-01 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sumo Social Share Boost plugin <= 4.4 versions. |
| CVE-2023-30749 | Medium | 2023-08-14 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin <= 7.3.0 versions. |
| CVE-2023-23688 | Medium | 2023-05-15 | Not applicable | No public exploit | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Sumo Social Share Boost plugin <= 4.4 versions. |
| CVE-2022-4227 | Medium | 2022-12-26 | Not applicable | No public exploit | The Booster for WooCommerce WordPress plugin before 5.6.3, Booster Plus for WooCommerce WordPress plugin before 6.0.0, Booster Elite for WooCommerce WordPress plugin before 6.0.0 do not escape some URLs and parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting |
| CVE-2022-4016 | Medium | 2022-12-12 | Not applicable | Proof of concept only | The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks |
| CVE-2022-3762 | Medium | 2022-11-21 | Not applicable | Proof of concept only | The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite) |
| CVE-2022-41805 | Medium | 2022-11-18 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress. |
| CVE-2021-36899 | Medium | 2022-10-11 | Not applicable | No public exploit | Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress. |
| CVE-2022-24140 | Medium | 2022-07-06 | Not applicable | No public exploit | IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint. |
| CVE-2021-24983 | Medium | 2022-02-01 | Not applicable | No public exploit | The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue |
| CVE-2021-24937 | Medium | 2022-02-01 | Not applicable | No public exploit | The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue |
| CVE-2021-25001 | Medium | 2022-01-03 | Not applicable | No public exploit | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue |
| CVE-2021-25000 | Medium | 2022-01-03 | Not applicable | No public exploit | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue |
| CVE-2021-24999 | Medium | 2022-01-03 | Not applicable | No public exploit | The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting |
| CVE-2021-34400 | Medium | 2021-11-20 | Not applicable | No public exploit | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to gain access to information from unscrubbed memory, which may lead to information disclosure. |
| CVE-2021-34399 | Medium | 2021-11-20 | Not applicable | No public exploit | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to gain access to information from unscrubbed registers, which may lead to information disclosure. |
| CVE-2021-23219 | Medium | 2021-11-20 | Not applicable | No public exploit | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to access protected information by identifying, exploiting, and loading vulnerable microcode. Such an attack may lead to information disclosure. |
| CVE-2021-1125 | Medium | 2021-11-20 | Not applicable | No public exploit | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to corrupt program data. |
| CVE-2021-1105 | Medium | 2021-11-20 | Not applicable | No public exploit | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to access debug registers during runtime, which may lead to information disclosure. |
| CVE-2021-1088 | Medium | 2021-11-20 | Not applicable | No public exploit | NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to utilize debug mechanisms with insufficient access control, which may lead to information disclosure. |
| CVE-2021-24776 | Medium | 2021-11-17 | Not applicable | No public exploit | The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. |
| CVE-2020-19924 | Medium | 2021-05-18 | Not applicable | No public exploit | In Boostnote 0.12.1, exporting to PDF contains opportunities for XSS attacks. |
| CVE-2020-27298 | Medium | 2021-01-26 | Not applicable | No public exploit | Philips Interventional Workspot (Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (Release 1.0), ViewForum (Release 6.3V1L10). The software constructs all or part of an OS command using externally influenced input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when sent to a downstream component. |
| CVE-2018-20966 | Medium | 2019-08-12 | Not applicable | No public exploit | The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature. |
| CVE-2019-12184 | Medium | 2019-05-19 | Not applicable | No public exploit | There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136. |
| CVE-2019-12136 | Medium | 2019-05-16 | Not applicable | No public exploit | There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element. |
| CVE-2018-13433 | Medium | 2018-07-08 | Not applicable | No public exploit | Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element. |
| CVE-2014-6025 | Medium | 2014-09-09 | Not applicable | No public exploit | The Chartboost library before 2.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2013-0252 | Medium | 2013-03-12 | Not applicable | No public exploit | boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes. |
| CVE-2011-1665 | Medium | 2011-04-10 | Not applicable | Working exploit published | PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain backup SQL files via a direct request for predictable filenames in cache/backup/. |
| CVE-2009-3654 | Medium | 2009-10-09 | Not applicable | No public exploit | Unspecified vulnerability in Boost before 6.x-1.03, a module for Drupal, allows remote attackers to create new webroot directories via unknown attack vectors. |
| CVE-2008-0172 | Medium | 2008-01-17 | Not applicable | No public exploit | The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (NULL dereference and crash) via an invalid regular expression. |
| CVE-2008-0171 | Medium | 2008-01-17 | Not applicable | No public exploit | regex/v4/perl_matcher_non_recursive.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (failed assertion and crash) via an invalid regular expression. |