The Request a Quote WordPress plugin before 2.3.5 does not sanitise validate or escape some of its settings in the admin dashboard leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.


The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users) leading to a Reflected Cross-Site Scripting issue


The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result an attacker could make a logged in admin update the settings to arbitrary values and set a Cross-Site Scripting payload in the Message Content. Depending on the options set the XSS payload can be triggered either in the backend only (in the plugin's settings) or both frontend and backend.


The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.


The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability.


The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used


The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks


The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag leading to a Stored Cross-Site Scripting issue.


The Workscout Core WordPress plugin before 1.3.4 used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues


In the GetPaid WordPress plugin before 2.3.4 users with the contributor role and above can create a new Payment Form however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited for example when an admin reviews it and could lead to privilege escalation.


The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.


The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes leading to Reflected Cross-Site Scripting issues


The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode


The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore one of the Button field is not escaped before being output in an attribute when editing a Button leading to a Stored Cross-Site Scripting issue as well.


The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed


The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled leading to a Reflected Cross-Site Scripting


The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV.


The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it leading to a Stored Cross-Site Scripting issue


The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed


The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.


The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page leading to Authenticated Stored Cross-Site Scripting issues.


The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htnl capability is disallowed.


The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its \Logo Title\ setting before outputting in a page leading to a Stored Cross-Site Scripting issue. Furthermore the plugin does not have CSRF check in place when saving its settings allowing the issue to be exploited via a CSRF attack.


The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed


The Social Share Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response leading to a Reflected Cross-Site Scripting issue.


The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table leading to an Unauthenticated Stored Cross-Site Scripting issue.


The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back leading to a reflected Cross-Site Scripting issue


The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response leading to a Reflected Cross-Site Scripting issue


The Steam Group Viewer WordPress plugin through 2.1 does not sanitise or escape its \Steam Group Address\ settings before outputting it in the page leading to an authenticated Stored Cross-Site Scripting issue


The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed


The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page leading to a Reflected Cross-Site Scripting issue


The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users allowing them to use malicious JavaScript code which will be executed when anyone visit a post in the frontend made by such user. As a result user with a role as low as author could perform Cross-Site Scripting attacks against users which could potentially lead to privilege escalation when an admin view the related post/s.


The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue


Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin versions before 4.0.0 lead to multiple Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location - Company - Email - URL


The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search Booking Confirmation and Personal Message pages leading to Cross-Site Scripting issues


The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filterssession_id of single_statistics page type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard leading to Reflected Cross-Site Scripting issues


The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute.


The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute leading to a Reflected Cross-Site Scripting


The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute leading to a Reflected Cross-Site Scripting


The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfiltered_html capability is disallowed.


The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the \File Thumbnail\ post meta before outputting it in some pages which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account or install a malicious plugin


The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting which result into a Stored Cross-Site Scripting (XSS). Furthermore the plugin also does not have any CSRF and capability checks in place when saving such setting allowing any authenticated user (as low as subscriber) or unauthenticated user via a CSRF vector to update them and perform such attack.


The

Asset

CleanUp:

Page

Speed

Booster

WordPress

plugin

before

does

not

sanitise

and

escape

POSted

parameters

sent

to

the

wpassetcleanup_fetch_active_plugins_icons

AJAX

action

(available

to

admin

users)

leading

to

a

Reflected

Cross-Site

Scripting

issue


The Cookie Bar WordPress plugin through 1.8.8 doesn't properly sanitise the Cookie Bar Message setting which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields leading to authenticated (admin+) Stored Cross-Site scripting issues


The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html is disallowed leading to an Authenticated Stored Cross-Site Scripting issue.


The Browser Screenshots WordPress plugin before 1.7.6 allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped.


The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes leading to Reflected Cross-Site Scripting issues


The Newsletter SMTP Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes leading to Reflected Cross-Site Scripting issues


The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsc_create_ticket shortcode embed leading to a Reflected Cross-Site Scripting issue


The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard leading to a Reflected Cross-Site Scripting issue


The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.


The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings allowing high privilege users to set XSS payloads in them leading to stored Cross-Site Scripting issues


The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash resulting in a DOM Cross-Site Scripting issue.


Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post triggered when users with the capability of editing posts access a malicious URL.


The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute leading to Reflected Cross-Site Scripting issues


The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page leading to a Reflected Cross-Site Scripting issue


The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks


The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7 there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However the field name is not sanitised or escaped before being output back in the page leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting allowing attackers to make a logged in admin set arbitrary Custom Fields including one with XSS payload in it.


The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page leading to a Reflected Cross-Site Scripting issue


The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings allowing high privilege users such as admin to se Cross-Site Scripting payload in them (even when the unfiltered_html capability is disallowed) which will be triggered in the frontend


The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place allowing attackers to make logged in administrators do unwanted actions such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses this could also lead to Stored Cross-Site Scripting issues


The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page leading to a Stored Cross-Site Scripting issue by high privilege users even when the unfiltered_html capability is disallowed


The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes leading Reflected Cross-Site Scripting issues


The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed which could lead to Cross-Site Scripting issues.


The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.


The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.


The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page unsanitized.


The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex still allowing other HTML tags and attributes to execute javascript which could lead to authenticated Stored Cross-Site Scripting issues.


The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings and set Cross-Site Scripting payload in them which will be executed in the frontend for all users


The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings and do not validate or escape them which could lead to Stored Cross-Site Scripting issue.


The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page leading to a Reflected Cross-Site Scripting issue


The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.


The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.


The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code allowing malicious code to be injected in it by high privilege users even when the unfiltered_html capability is disallowed which could lead to Stored Cross-Site Scripting issues


The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks


The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment allowing low privilege users such as subscriber to set JavaScript in them leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the \Calendar\ page and the malicious script is executed in the admin context.


The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.


The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks


The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks


The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The SVG Support WordPress plugin before 2.3.20 does not escape the \CSS Class to target\ setting before outputting it in an attribute which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page leading to a Reflected Cross-Site Scripting issue


The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings allowing any authenticated users (such as subscriber) to change them. If users can't register this can be done through CSRF. Furthermore the cookie banner setting is not sanitised or validated before being output in all pages of the frontend and the backend settings one leading to a Stored Cross-Site Scripting issue.


The WP SMS WordPress plugin before 5.4.13 does not sanitise the \wp_group_name\ parameter before outputting it back in the \Groups\ page leading to an Authenticated Stored Cross-Site Scripting issue


The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The MP3 Audio Player for Music Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings allowing high privilege users to perform Cross-Site Scripting attacks


The Community Events WordPress plugin before 1.4.8 does not sanitise validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator


The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings nor has any CSRF check in place allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.


The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin leading to Stored Cross-Site scripting issues when the quote is output in the \Quotes list\ even when the unfiltered_html capability is disallowed


This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check the attack could also be performed via such vector.


The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.


The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject Email Recipient etc) when creating or editing a form leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator.


The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page leading to a Reflected Cross-Site Scripting issue


The Glass WordPress plugin through 1.3.2 does not sanitise or escape its \Glass Pages\ setting before outputting in a page leading to a Stored Cross-Site Scripting issue. Furthermore the plugin did not have CSRF check in place when saving its settings allowing the issue to be exploited via a CSRF attack.


The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads


The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting which could allow high privilege users to perform Cross-Site Scripting attacks


The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings which could allow high privilege users to perform Cross-Site Scripting attacks


The WP Foodbakery WordPress plugin before 2.2 used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.


The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields.


The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the \Default Publisher ID\ field on the plugin's settings page.


The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page leading to a Reflected Cross-Site Scripting issue


The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.


The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)


The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page leading to an unauthenticated reflected Cross-Site Scripting issue.


The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting


The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved allowing for Cross-Site Scripting issues. Furthermore it is also lacking any CSRF check allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.


Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin versions before 3.9.3 was vulnerable to authenticated Stored Cross-Site Scripting (XSS) which could lead to privilege escalation.


The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page leading to a Reflected Cross-Site Scripting


The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field when an administrator or any authenticated user go to the chat the XSS will be automatically executed.


The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings allowing attacker to make a logged in user with the manage_options change them. Furthermore the settings are not escaped when output in attributes leading to a Stored Cross-Site Scripting issue.


The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.


The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.


The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.


The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.


The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page which could lead to a Stored Cross-Site Scripting issue


The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed


The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page leading to a Reflected Cross-Site Scripting (XSS) vulnerability.


The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues.


The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings and do not sanitise or escape user input before outputting them back in the page leading to a Stored Cross-Site Scripting issue


The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the \extension\ parameter in the Extensions dashboard when the 'Anonymously track usage to improve product quality' setting is enabled as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker who can convince an authenticated admin into clicking a link to run malicious JavaScript within the user's web browser which could lead to full site compromise.


The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout iconSet steps ingredients recipeTitle or settings) which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.


The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks


The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz which could lead to Stored Cross-Site Scripting issues


The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users) which could allow any authenticated users such as subscriber to call them and perform Stored Cross-Site Scripting attacks against logged in admin as well as frontend users due to the lack of sanitisation and escaping in some parameters


The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute leading to a reflected Cross-Site Scripting issue


The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfiltered_html capability is disallowed.


The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks


The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.


The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form


The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used) allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page leading to a Stored Cross-Site Scripting issue. Furthermore the plugin does not have CSRF check in place when saving its options allowing the issue to be exploited via a CSRF attack.


The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title allowing high privilege users such as admin to set Cross-Site Scripting payload in them even when the unfiltered_html capability is disallowed


The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page leading to a Reflected Cross-Site Scripting issue


The settings page of the Select All Categories and Taxonomies Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back leading to a reflected Cross-Site Scripting issue


The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response leading to a Reflected cross-Site Scripting issue


The

Responsive

WordPress

Slider

WordPress

plugin

through

does

not

sanitise

and

escape

some

of

the

Slider

options

allowing

Cross-Site

Scripting

payloads

to

be

set

in

them.

Furthermore

as

by

default

any

authenticated

user

is

allowed

to

create

Sliders

such

settings

can

be

changed

in

the

plugin's

settings)

this

would

allow

user

with

a

role

as

low

as

subscriber

to

perform

Cross-Site

Scripting

attacks

against

logged

in

admins

viewing

the

slider

list

and

could

lead

to

privilege

escalation

by

creating

a

rogue

admin

account

for

example.


The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes\ table.


The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users) allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin


The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes allowing users with a role as low as contributor to perform Cross-Site Scripting attacks


The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings allowing high privilege users (admin) to set XSS payloads in them leading to Stored Cross-Site Scripting issues.


The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off leading to a Stored Cross-Site Scripting issue


The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake BMI calculator protein Intake and Body Fat and was lacking CSRF check allowing attackers to make logged in users perform unwanted actions such as change the calculator headers. Due to the lack of sanitisation this could also lead to a Stored Cross-Site Scripting issue


The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page leading to the Cross-SIte Scripting issue.


The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)


The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings and do not sanitise or escape them before outputting them back in the page leading to a stored Cross-Site Scripting issue via a CSRF attack


The

ACF

Photo

Gallery

Field

WordPress

plugin

before

does

not

sanitise

and

escape

the

post

parameter

in

the

includes/acf_photo_gallery_metabox_edit.php

file

before

outputing

back

in

an

attribute

leading

to

a

Reflected

Cross-Site

Scripting

issue


The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting it back leading to a Reflected Cross-Site Scripting in the admin dashboard


The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed which could lead to Cross-Site Scripting issues.


The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.


The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator


The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Stop Spammers Security | Block Spam Users Comments Forms WordPress plugin before 2021.18 does not escape some of its settings allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed


The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator


The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute leading to a Reflected Cross-Site Scripting issue


The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3.


Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.


Laravel is a web application framework. Laravel prior to versions 8.75.0 7.30.6 and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0 7.30.6 and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.


A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the (1) domain and (2) path parameters.


jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visible but an attacker can use other techniques to hide the code the victim sees. If the application uses the `execHash` option and executes code from URL the attacker can use this URL to execute their code. The scope is limited because the javascript attribute used is added to span tag so no automatic execution like with `onerror` on images is possible. This issue is fixed in version 2.31.1. As a workaround the user can use formatting that wrap whole user input and its no op. The code for this workaround is available in the GitHub Security Advisory. The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way).


A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.


Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1) Add new Client and (2) Add new invoice.


Wiki.js

is

a

wiki

app

built

on

Node.js.

Wiki.js

and

earlier

is

vulnerable

to

stored

cross-site

scripting

through

non-image

file

uploads

for

file

types

that

can

be

viewed

directly

inline

in

the

browser.

By

creating

a

malicious

file

which

can

execute

inline

JS

when

viewed

in

the

browser

(e.g.

XML

files)

a

malicious

Wiki.js

user

may

stage

a

stored

cross-site

scripting

attack.

This

allows

the

attacker

to

execute

malicious

JavaScript

when

the

file

is

viewed

directly

by

other

users.

The

file

must

be

opened

directly

by

the

user

and

will

not

trigger

directly

in

a

normal

Wiki.js

page.

A

patch

in

version

fixes

this

vulnerability

by

adding

an

optional

(enabled

by

default)

force

download

flag

to

all

non-image

file

types

preventing

the

file

from

being

viewed

inline

in

the

browser.

As

a

workaround

disable

file

upload

for

all

non-trusted

users.

Thanks

to

@Haxatron

for

reporting

this

vulnerability.

Initially

reported

via


A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file.


Wiki.js

is

a

wiki

app

built

on

Node.js.

Wiki.js

versions

and

earlier

are

vulnerable

to

stored

cross-site

scripting

through

a

SVG

file

upload.

By

creating

a

crafted

SVG

file

a

malicious

Wiki.js

user

may

stage

a

stored

cross-site

scripting

attack.

This

allows

the

attacker

to

execute

malicious

JavaScript

when

the

SVG

is

viewed

directly

by

other

users.

Scripts

do

not

execute

when

loaded

inside

a

page

via

normal

`<img>`

tags.

Commit

fixes

this

vulnerability

by

adding

an

optional

(enabled

by

default)

SVG

sanitization

step

to

all

file

uploads

that

match

the

SVG

mime

type.

As

a

workaround

disable

file

upload

for

all

non-trusted

users.

Wiki.js

version

is

the

first

production

version

to

contain

a

patch.

Version

is

the

first

development

build

to

contain

a

patch

and

is

available

only

as

a

Docker

image

as


totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp.


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15 and from version 8.14.0 before 8.20.3.


A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0 version 6.4.5 and below version 6.3.7 and below version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.


A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0 version 6.3.15 and below version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage.


Affected

versions

of

Atlassian

Jira

Service

Management

Server

and

Data

Center

allow

attackers

with

administrator

privileges

to

inject

arbitrary

HTML

or

JavaScript

via

a

Cross-Site

Scripting

(XSS)

vulnerability

in

the

\Object

Schema\

field

of

The

affected

versions

are

before

version


A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL.


Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via normal `<img>` tags. The malicious SVG can only be uploaded by crafting a custom request to the server with a fake MIME type. A patch in version 2.5.264 fixes this vulnerability by adding an additional file extension verification check to the optional (enabled by default) SVG sanitization step to all file uploads that match the SVG mime type. As a workaround disable file upload for all non-trusted users.


A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter.


SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) versions - SAP_UI - 750 752 753 754 755 SAP_BASIS - 702 731 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


NWDI Notification Service versions - 7.31 7.40 7.50 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.SAP NetWeaver Development Infrastructure Notification Service allows a threat actor to send crafted scripts to a victim. If the victim has an active session when the crafted script gets executed the threat actor could compromise information in victims session and gain access to some sensitive information also.


A

reflected

cross-site

scripting

(XSS)

vulnerability

in

Shopizer

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

ref

parameter

to

a

page

about

an

arbitrary

product

e.g.

a

product/insert-product-name-here.html/ref=

URL.


Cross-site

scripting

(XSS)

vulnerability

in

the

Asset

module's

edit

vocabulary

page

in

Liferay

Portal

through

and

Liferay

DXP

before

fix

pack

before

fix

pack

and

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_journal_web_portlet_JournalPortlet_name

or

_com_liferay_document_library_web_portlet_DLAdminPortlet_name

parameter.


A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9) Teamcenter Active Workspace V5.0 (All versions < V5.0.7) Teamcenter Active Workspace V5.1 (All versions < V5.1.4). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected devices that could allow an attacker to execute malicious JavaScript code by tricking users into accessing a malicious link.


A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the \Duplicate Title\ text box executes whenever the user opens the Settings Page of the Post Duplicator Plugin or the application root page after duplicating any of the existing posts.


A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.


SAP Cloud Connector version - 2.0 does not sufficiently encode user-controlled inputs allowing an attacker with Administrator rights to include malicious codes that get stored in the database and when accessed could be executed in the application resulting in Stored Cross-Site Scripting.


SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) versions - KRNL64NUC - 7.49 KRNL64UC - 7.49 7.53 KERNEL - 7.49 7.53 7.77 7.81 7.84 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


Cross-site

scripting

(XSS)

vulnerability

in

the

Fragment

module

in

Liferay

Portal

through

and

Liferay

DXP

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_site_admin_web_portlet_SiteAdminPortlet_name

parameter.


A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend e.g. in admin/customers/list.html.


Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing internal information and performing actions in context of an authenticated user.


There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload executes whenever the user changes the clarity configuration in Microsoft Clarity version 0.3. The payload is stored on the configuring project Id page.


Cross-site

scripting

(XSS)

vulnerability

in

the

Document

Library

module's

add

document

menu

in

Liferay

Portal

through

and

Liferay

DXP

before

fix

pack

and

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter.


SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability. This would allow an attacker with basic level privileges to store a malicious script on SAP Lumira Server. The execution of the script content by a victim registered on SAP Lumira Server could compromise the confidentiality and integrity of SAP Lumira content.


Under certain conditions NetWeaver Enterprise Portal versions - 7.30 7.31 7.40 7.50 does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting (XSS) vulnerability.


The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim who accesses a specially crafted malicious URL would unknowingly execute the attached payload.


Under certain conditions NetWeaver Enterprise Portal versions - 7.10 7.11 7.20 7.30 7.31 7.40 7.50 does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack a victim opens the report and the malicious script gets executed in the victim's browser resulting in a Stored Cross-Site Scripting (XSS) vulnerability.


Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier and Liferay DXP 7.0 before fix pack 96 7.1 before fix pack 20 and 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the title of a modal window.


Cross-site

scripting

(XSS)

vulnerability

in

the

Portlet

Configuration

module

in

Liferay

Portal

through

and

Liferay

DXP

before

fix

pack

and

before

fix

pack

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource

parameter.


A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the \Custom logo link\ executes whenever the user opens the Settings Page of the \Customize Login Image\ Plugin.


Cross-site

scripting

(XSS)

vulnerability

in

the

Journal

module's

add

article

menu

in

Liferay

Portal

through

and

Liferay

DXP

fix

pack

and

fix

pack

through

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

_com_liferay_journal_web_portlet_JournalPortlet_name

parameter.


webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients section due to incorrect sanitization of user-supplied data and achieve a Stored Cross-Site Scripting attack against the platform users and administrators. The affected endpoint is /clients/editclient.php on the HTTP POST cn parameter.


A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44) Climatix POL909 (AWM module) (All versions < V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens redirecting the user to a malicious webpage and performing unintended browser action.


Affected

versions

of

Atlassian

Jira

Server

and

Data

Center

allow

anonymous

remote

attackers

to

inject

arbitrary

HTML

or

JavaScript

via

a

Cross-Site

Scripting

(XSS)

vulnerability

in

the

Associated

Projects

feature

(/secure/admin/AssociatedProjectsForCustomField.jspa).

The

affected

versions

are

before

version

from

version

before

and

from

version

before


Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12 and from version 8.14.0 before 8.20.2.


ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL malicious JavaScript content may be executed within the context of the victim's browser.


Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue.


Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters to protect against cross-site scripting (XSS) attacks. The default snippet for the image block unfortunately did not use our escaping helper. This made it possible to include malicious HTML code in the source alt and link fields of the image block which would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. Attackers must be in your group of authenticated Panel users in order to exploit this weakness. Users who do not make use of the blocks field are not affected. This issue has been patched in Kirby version 3.5.8 by escaping special HTML characters in the output from the default image block snippet. Please update to this or a later version to fix the vulnerability.


nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint) nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created and the base string is passed through to the request API function. From there the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product.


Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8 cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.


Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types it is not possible to escape HTML special characters against cross-site scripting (XSS) attacks otherwise the formatting would be lost. If the user is logged in to the Panel a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Because the writer field did not securely sanitize its contents on save it was possible to inject malicious HTML code into the content file by sending it to Kirby's API directly without using the Panel. This malicious HTML code would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. Attackers must be in your group of authenticated Panel users in order to exploit this weakness. Users who do not make use of the writer field are not affected. This issue has been patched in Kirby 3.5.8 by sanitizing all writer field contents on the backend whenever the content is modified via Kirby's API. Please update to this or a later version to fix the vulnerability.


webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the application because it is related on how each URL is echoed back on every response page.


A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button.


Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.


OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0 a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()`` there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.


A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44) Climatix POL909 (AWM module) (All versions < V11.36). The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens redirecting the user to a malicious webpage and performing unintended browser action.


A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extraction of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.


A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older which allows the injection of unauthenticated specially-crafted web requests without proper sanitization.


A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter.


A persistent cross-site scripting (XSS) vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper Networks Junos OS: All versions including the following supported releases: 12.3X48 versions prior to 12.3X48-D105; 15.1X49 versions prior to 15.1X49-D220; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S3; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R1-S1 20.2R2; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R2; 21.1 versions prior to 21.1R2.


Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account the XSS payload will be executed.


A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extract of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.


Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. This would be triggered when any authorized user logs into the DBSec interface and opens the properties configuration page for this database.


Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's Captive Portal.


A persistent Cross-Site Scripting (XSS) vulnerability in Juniper Networks Junos OS on SRX Series J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web administration session or hijack another user's active session to perform administrative actions. This issue affects: Juniper Networks Junos OS on SRX Series: 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S7 19.2R3-S3; 19.3 versions prior to 19.3R2-S6 19.3R3-S3; 19.4 versions prior to 19.4R1-S4 19.4R2-S4 19.4R3-S3; 20.1 versions prior to 20.1R2-S2 20.1R3; 20.2 versions prior to 20.2R3-S1; 20.3 versions prior to 20.3R2-S1 20.3R3.


CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.


A cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur (during record deletion) via the Time-off parameter.


Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15 5.4.0 through 5.4.13 5.6.0 through 5.6.14 6.0.0 through 6.0.12 6.2.0 through 6.2.7 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.


Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14 from version 8.6.0 before 8.13.6 and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.


A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). HPE has provided the following software update to resolve the vulnerability in HPE iLO Amplifier Pack: HPE iLO Amplifier Pack 1.95 or later.


Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.


GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input making it possible to perform cross-site scripting attacks which may be used to send a malicious script. Also UR Firmware web server does not perform HTML encoding of user-supplied strings.


SAP Manufacturing Execution (System Rules) versions - 15.1 15.2 15.3 15.4 allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.g. information can be read modified and sent to the attacker. However availability of the server cannot be impacted.


A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request a different vulnerability than CVE-2019-3905.


A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.


The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability which could allow an unauthenticated remote attacker to inject malicious JavaScript code.


SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file it results in a Cross-Site Scripting (XSS) vulnerability and the attacker can read and modify data. However the attacker does not have control over kind or degree.


SAP Manufacturing Execution versions - 15.1 1.5.2 15.3 15.4 does not contain some HTTP security headers in their HTTP response. The lack of these headers in response can be exploited by the attacker to execute Cross-Site Scripting (XSS) attacks.


CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter.


\HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability\


Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active which can be used to perform further attacks such as reading browser history directory listings and file contents.


Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.


The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability which can lead to attackers carrying out arbitrary code execution.


The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions such as stealing victims' session tokens or login credentials performing arbitrary actions on their behalf and logging their keystrokes.


A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0 CloverDX 5.8.1 CloverDX 5.7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10.


RiyaLab CloudISO event item is added special characters in specific field of time management page are not properly filtered which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks.


Knowage

Suite

is

vulnerable

to

Stored

Cross-Site

Scripting

(XSS).

An

attacker

can

inject

arbitrary

web

script

in

'/knowage/restful-services/signup/update'

via

the

'surname'

parameter.


Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.


Knowage

Suite

before

is

vulnerable

to

cross-site

scripting

(XSS).

An

attacker

can

inject

arbitrary

external

script

in

'/knowagecockpitengine/api/1.0/pages/execute'

via

the

parameter.


Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.


Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.


A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious code into the OTK web UI client application.


Knowage

Suite

is

vulnerable

to

Stored

Cross-Site

Scripting

(XSS).

An

attacker

can

inject

arbitrary

web

script

in

'/knowage/restful-services/documentnotes/saveNote'

via

the

'nota'

parameter.


Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute JavaScript code through the link_url parameter in Ajax_url_encode.php.


Cross-site

scripting

(XSS)

vulnerability

in

in

Ecommerce-CodeIgniter-Bootstrap

(Codeigniter

Bootstrap

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter.


A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.


Microsoft Dynamics Business Central Cross-site Scripting Vulnerability


Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities see the Details section of this advisory.


Adobe Connect version 11.2.3 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page malicious JavaScript content may be executed within the context of the victim's browser.


A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page malicious JavaScript content may be executed within the context of the victim's browser


OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php. An attacker can inject JavaScript code to get the user's cookie and take over the working session of user.


Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability


Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Uploader.class.php and return a wrong response in content-type of output data in webroot/dzz/attach/controller.php.


A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded which could be used in a XSS attack.


Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take advantage to exploit multiple web attacks and stole sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.


Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site aka the \IIS Cross-Site Scripting\ vulnerabilities.


Variant of the \IIS Cross-Site Scripting\ vulnerability as originally discussed in MS:MS00-060 (CVE-2000-0746) allows a malicious web site operator to embed scripts in a link to a trusted site which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site.


Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly calling the com.livesoftware.jrun.plugins.JSP JSP servlet.


Cross-site scripting (XSS) vulnerability in W1L3D4_aramasonuc.asp in W1L3D4 Philboard 0.3 allows remote attackers to inject arbitrary web script or HTML via the searchterms parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) msg (2) page (3) viewkey or (4) viewtype parameter to (a) view_video.php; the (5) next parameter to (b) signup.php; the (6) search_id parameter to (c) search_result.php; the (7) category or (8) page parameter to (d) video.php; the (9) receiver parameter to (e) compose.php; the (10) catgy parameter to (f) groups.php; the (11) channelname parameter to (g) siteadmin/channels.php; or the (12) uname parameter to (h) siteadmin/muser.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

InterWorx

Hosting

Control

Panel

(InterWorx-CP)

Webmaster

Level

(SiteWorx)

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

index.php;

and

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

to

siteworx.php

users.php

ftp.php

mysql.php

domains.php

htaccess.php

scriptworx.php

stats.php

backup.php

restore.php

and

httpd.php;

and

unspecified

vectors

to

cron.php

and

prefs.php.


Cross-site scripting (XSS) vulnerability in admin/adminusers.php in Claroline before 1.8.6 allows remote authenticated administrators to inject arbitrary web script or HTML via the sort parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in the CAD service in IBM Tivoli Storage Manager (TSM) Client 5.3.5.3 and 5.4.1.2 for Windows allows remote attackers to inject arbitrary web script or HTML via HTTP requests to port 1581 which generate log entries in a dsmerror.log file that is accessible through a certain web interface.


Cross-site scripting (XSS) vulnerability in Mayaa before 1.1.12 allows remote attackers to inject arbitrary web script or HTML in certain circumstances involving (1) lack of charset specification within a META element or (2) a META element that specifies an unrecognized charset which trigger automatic character set recognition by the web browser as demonstrated by improper handling of UTF-7 data.


Cross-site

scripting

(XSS)

vulnerability

in

in

MitriDAT

eMail

Form

Processor

Pro

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

possibly

related

to

formprocessorpro.php

in

the

PHP

version

of

the

product

and

formprocessorpro.pl

in

the

Perl

version

of

the

product.


** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the (1) s parameter to index.php and the (2) q parameter to (a) faq.php (b) member.php (c) memberlist.php (d) calendar.php (e) search.php (f) forumdisplay.php (g) showgroups.php (h) online.php and (i) sendmessage.php. NOTE: these issues have been disputed by the vendor stating \I can't reproduce a single one of these\. The researcher is known to be unreliable.


Multiple cross-site scripting (XSS) vulnerabilities in Storesprite 7 and earlier allow remote attackers to inject arbitrary web script or HTML via the next parameter to (1) addaddress.php (2) editshipdetails.php (3) register.php or (4) login.php in secure/.


Cross-site scripting (XSS) vulnerability in Ipswitch WS_FTP allows remote attackers to inject arbitrary web script or HTML via arguments to a valid command which is not properly handled when it is displayed by the view log option in the administration interface. NOTE: this can be leveraged to create a new admin account.


Multiple cross-site scripting (XSS) vulnerabilities in the AkoBook 3.42 and earlier component (com_akobook) for Mambo allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) gbmail and (2) gbpage parameters in the sign function.


Multiple cross-site scripting (XSS) vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via one or more of the following vectors: the (1) id parameter to (a) pages/delete_page.php (b) navigation/delete_menu.php and (c) navigation/delete_item.php in admin/; the (2) menu_id (3) name (3) page_id and (4) url parameters in (d) admin/navigation/do_new_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1 name and url parameters to (f) admin/pages/do_new_page.php probably involving the Title or textarea field as reachable through admin/pages/new_page.php. NOTE: the original disclosure does not precisely state which vectors are associated with SQL injection versus XSS.


Multiple cross-site scripting (XSS) vulnerabilities in Boinc Forum 5.10.20 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to forum_forum.php or the search_string parameter to forum_text_search_action.php in a (2) titles or (3) bodies search.


Cross-site scripting (XSS) vulnerability in Sophos Anti-Virus for Windows 6.x before 6.5.8 and 7.x before 7.0.1 allows remote attackers to inject arbitrary web script or HTML via an archive with a file that matches a virus signature and has a crafted filename that is not properly handled by the print function in SavMain.exe.


CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter. NOTE: this can be leveraged for cross-site scripting (XSS) attacks. NOTE: some of these details are obtained from third party information.


The javadoc tool in Cosminexus Developer's Kit for Java in Cosminexus 7 and 7.5 can generate HTML documents that contain cross-site scripting (XSS) vulnerabilities which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this is probably the same issue as CVE-2007-3503.


Cross-site scripting (XSS) vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter possibly a related issue to CVE-2007-2757 and CVE-2007-4014. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Cross-site scripting (XSS) vulnerability in utilities/login.asp in nukedit 4.9.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.13 (aka Sunglow) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the (1) com_search (2) com_content and (3) mod_login components. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in Domino Blogsphere 3.01 Beta 7 allows remote attackers to inject arbitrary web script or HTML via the name field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in yorumkaydet.asp in Dersimiz Haber Ekleme Modulu allow remote attackers to inject arbitrary web script or HTML via the (1) yazan (2) mail and (3) yorum parameters. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in a certain index.php installation script related to the (1) Blix 0.9.1 (2) Blixed 1.0 and (3) BlixKrieg (Blix Krieg) 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter possibly a related issue to CVE-2007-2757. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

InterWorx

Hosting

Control

Panel

(InterWorx-CP)

Server

Admin

Level

(NodeWorx)

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

index.php;

and

allow

remote

authenticated

users

to

inject

arbitrary

web

script

or

HTML

via

the

to

nodeworx.php

users.php

lang.php

themes.php

setup.php

siteworx.php

packages.php

backup.php

import.php

scriptworx.php

resellers.php

reseller-packages.php

http.php

mail.php

ftp.php

mysql.php

sshd.php

nfs.php

cron.php

ip.php

firewall.php

updates.php

rrd.php

or

cluster.php.


Cross-site scripting (XSS) vulnerability in pframe.php in AbleDesign Dynamic Picture Frame 1.00 allows remote attackers to inject arbitrary web script or HTML via the img_url parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the (1) f_emailaddress (2) f_reemailaddress and other unspecified parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) dir parameter in admin/adminusers.php the (2) action parameter in admin/advancedUserSearch.php and the (3) view parameter in admin/campusProblem.php.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows (2) sql_query or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE: vector 5 might be a regression or incomplete fix for CVE-2006-6942.7.


Cross-site scripting (XSS) vulnerability in tiki-remind_password.php in Tikiwiki (aka Tiki CMS/Groupware) 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: this issue might be related to CVE-2006-2635.7.


Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel accessed through options.php; or (2) the opml_url parameter to link-import.php. NOTE: this might not cross privilege boundaries in some configurations since the Administrator role has the unfiltered_html capability.


Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2 and 4.7.x before 4.7.7 (1) allow remote attackers to inject arbitrary web script or HTML via \some server variables \ including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names.


Multiple cross-site scripting (XSS) vulnerabilities in Netjuke 1.0-rc2 allow remote attackers to inject arbitrary web script or HTML via (1) the val parameter to alphabet.php in an alpha.albums action or the PATH_INFO to (2) random.php or (3) admin/hidden.php.


Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program.


Cross-site scripting (XSS) vulnerability in index.php in the Unnamed theme 1.217 and Special Edition (SE) 1.02 before 20070804 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter possibly a related issue to CVE-2007-2757 CVE-2007-4014 and CVE-2007-4165. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via a trailing \<\ instead of a \>\ in (1) the onerror attribute of an IMG element (2) the onload attribute of an IFRAME element or (3) redirect users to other sites via the META tag.


Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Text Ads Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) r parameter to (a) forgot_uid.php the (2) query or (3) sk parameter to (b) search_results.php or (4) the pageId parameter to (c) website_page.php.


Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI for (1) index.php (2) i_frames/i_login.php and (3) i_frames/i_top_tags.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string.


Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4 1.9.0 through 1.9.3 1.10.0 through 1.10.1 and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A 7.0.0.2_iFix01 and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid (2) username (3) userNameVal and (4) schema parameters to the login component.


Multiple cross-site scripting (XSS) vulnerabilities in Toms Gaestebuch 1.00 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage (2) mail and (3) name parameters in a show action to (a) form.php; the (4) language and (5) anzeigebreite parameters to (b) admin/header.php; and the (6) msg parameter to (c) install.php different vectors than CVE-2006-0706.


Cross-site scripting (XSS) vulnerability in Forms/General_1 in the management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allows remote authenticated administrators to inject arbitrary web script or HTML via the sysSystemName parameter.