Overview 44 matches · 0 in Waratek scope · 0 protected · 3 exploited · 0 CISA KEV · 5 public PoC · 3 EPSS ≥ 0.5
44matches
0in Waratek scope0.0%
0protected0.0%
3exploited6.8%
0CISA KEV0.0%
5public PoC11.4%
3EPSS ≥ 0.56.8%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
44
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
44
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 12 / year
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20142
Not applicable2
Medium1
Low1
not blocked2
No public exploit2
20152
Not applicable2
Medium2
not blocked2
No public exploit2
20160
20172
Not applicable2
High1
Medium1
not blocked2
Exploited1
No public exploit1
20188
Not applicable8
Critical4
High2
Medium2
not blocked8
Exploited1
Working exploit published1
No public exploit6
20190
20202
Not applicable2
Critical1
Medium1
not blocked2
Exploited1
No public exploit1
20217
Not applicable7
High4
Medium3
not blocked7
Working exploit published1
No public exploit6
202212
Not applicable12
Critical1
High4
Medium7
not blocked12
No public exploit12
20236
Not applicable6
High2
Medium4
not blocked6
Proof of concept only2
No public exploit4
20241
Not applicable1
High1
not blocked1
No public exploit1
20251
Not applicable1
High1
not blocked1
No public exploit1
2013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-28861 | High | 2025-03-11 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian Datepicker: from n/a through <= 0.1.0. |
| CVE-2024-24849 | High | 2024-02-21 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1. |
| CVE-2023-5432 | Medium | 2023-12-19 | Not applicable | No public exploit | The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2023-5464 | High | 2023-10-31 | Not applicable | No public exploit | The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2023-5430 | High | 2023-10-31 | Not applicable | No public exploit | The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2023-4890 | Medium | 2023-09-12 | Not applicable | No public exploit | The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2021-32850 | Medium | 2023-02-20 | Not applicable | Proof of concept only | jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6. |
| CVE-2023-0171 | Medium | 2023-02-06 | Not applicable | Proof of concept only | The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. |
| CVE-2022-2144 | Medium | 2022-07-17 | Not applicable | No public exploit | The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like default_role, users_can_register via a CSRF attack |
| CVE-2022-31147 | High | 2022-07-14 | Not applicable | No public exploit | The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch. |
| CVE-2021-43306 | High | 2022-06-02 | Not applicable | No public exploit | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method |
| CVE-2022-30241 | Medium | 2022-05-04 | Not applicable | No public exploit | The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element. |
| CVE-2022-1291 | Medium | 2022-04-10 | Not applicable | No public exploit | XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers |
| CVE-2022-23395 | Medium | 2022-03-02 | Not applicable | No public exploit | jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). |
| CVE-2021-37504 | Medium | 2022-02-25 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name. |
| CVE-2022-24985 | High | 2022-02-16 | Not applicable | No public exploit | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server. |
| CVE-2022-24984 | Critical | 2022-02-16 | Not applicable | No public exploit | Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content (e.g., .phtml or .php.bak) is blocked. |
| CVE-2022-24983 | High | 2022-02-16 | Not applicable | No public exploit | Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained with CVE-2022-24984, this could lead to unauthenticated remote code execution on the underlying web server. This occurs because the Unique ID field is contained in the POST response upon submitting a form. |
| CVE-2022-24982 | Medium | 2022-02-16 | Not applicable | No public exploit | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials. |
| CVE-2022-24981 | Medium | 2022-02-16 | Not applicable | No public exploit | A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php. |
| CVE-2021-43862 | Medium | 2021-12-30 | Not applicable | No public exploit | jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visible, but an attacker can use other techniques to hide the code the victim sees. If the application uses the `execHash` option and executes code from URL, the attacker can use this URL to execute their code. The scope is limited because the javascript attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible. This issue is fixed in version 2.31.1. As a workaround, the user can use formatting that wrap whole user input and its no op. The code for this workaround is available in the GitHub Security Advisory. The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way). |
| CVE-2021-24543 | Medium | 2021-10-25 | Not applicable | No public exploit | The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue. |
| CVE-2021-34663 | Medium | 2021-08-16 | Not applicable | No public exploit | The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5. |
| CVE-2021-20087 | High | 2021-04-23 | Not applicable | No public exploit | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties into Object.prototype. |
| CVE-2021-20086 | High | 2021-04-23 | Not applicable | Working exploit published | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype. |
| CVE-2021-20084 | High | 2021-04-23 | Not applicable | No public exploit | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype. |
| CVE-2021-20083 | High | 2021-04-23 | Not applicable | No public exploit | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype. |
| CVE-2018-18405 | Medium | 2020-04-22 | Not applicable | No public exploit | jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry |
| CVE-2014-8739 | Critical | 2020-02-08 | Not applicable | Exploited | Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014. |
| CVE-2018-9207 | Critical | 2018-11-19 | Not applicable | No public exploit | Arbitrary file upload in jQuery Upload File <= 4.0.2 |
| CVE-2018-9208 | Critical | 2018-11-05 | Not applicable | No public exploit | Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta |
| CVE-2018-9206 | Critical | 2018-10-11 | Not applicable | Exploited | Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0 |
| CVE-2018-0645 | Critical | 2018-09-07 | Not applicable | No public exploit | MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors. |
| CVE-2017-16045 | High | 2018-06-04 | Not applicable | No public exploit | `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| CVE-2016-10707 | High | 2018-01-18 | Not applicable | No public exploit | jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit. |
| CVE-2012-6708 | Medium | 2018-01-18 | Not applicable | Working exploit published | jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. |
| CVE-2014-6071 | Medium | 2018-01-16 | Not applicable | No public exploit | jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after. |
| CVE-2017-1000170 | High | 2017-11-17 | Not applicable | Exploited | jqueryFileTree 2.1.5 and older Directory Traversal |
| CVE-2015-7943 | Medium | 2017-10-18 | Not applicable | No public exploit | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233. |
| CVE-2015-1840 | Medium | 2015-07-26 | Not applicable | No public exploit | jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value. |
| CVE-2015-2089 | Medium | 2015-02-26 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php. |
| CVE-2012-6662 | Medium | 2014-11-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo. |
| CVE-2013-4383 | Low | 2014-01-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the jQuery Countdown module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-4969 | Medium | 2013-03-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag. |