Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1 6.2 and 6.3 corresponding security measures are also available via a plugin.


OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). To exploit the vulnerability the attacker needs to manipulate the name of some device on your computer such as a printer replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting (XSS).


The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard leading to a Reflected Cross-Site Scripting


The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard leading to a Reflected Cross-Site Scripting


Vicidial 2.14-783a was discovered to contain a cross-site scripting (XSS) vulnerability via the input tabs.


An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php.


The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard leading to a Reflected Cross-Site Scripting


An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to a Stored Cross-Site Scripting vulnerability.


The \first name\ and \last name\ fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.


Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5


Stored

cross-site

scripting

(XSS)

vulnerability

in

Hospital

Information

Management

Alpha.

The

vulnerability

has

found

POST

requests

in

page

with

\station\

parameters.


Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the download file feature on a manager profile due to lack of input validation.


Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp2post_type.


Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: &blockcountry_blockmessage.


In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page \ActivityStreamAjax.i4\.


Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3


The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact


Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2


Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product.


Microsoft Dynamics Business Central Cross-site Scripting Vulnerability


Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user profile due to lack of input validation.


Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name Value > &attributes Name > &attributes &icons &names &description &link &title.


Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.


Adobe Connect version 11.2.2 (and earlier) is affected by a Reflected Cross-site Scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page malicious JavaScript content may be executed within the context of the victim's browser.


Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager (WordPress plugin) versions <= 2.4.13.


TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module.


Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product.


Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6) vulnerable parameters (&id &assignee).


TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module.


Authenticated Stored Cross-Site Scripting (XSS) vulnerability in WordPress Absolutely Glamorous Custom Admin plugin (versions <= 6.8). Stored XSS possible via unsanitized input fields of the plugin settings some of the payloads could make the frontend and the backend inaccessible.


A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers


Authenticated

Stored

Cross-Site

Scripting

(XSS)

vulnerability

in

YITH

Maintenance

Mode

(WordPress

plugin)

versions

vulnerable

parameter

&yith_maintenance_newsletter_submit_label.

Possible

even

when

unfiltered

HTML

is

disallowed

by

WordPress

configuration.


Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulnerable parameters: &dataset_name &wpgmza_gdpr_retention_purpose &wpgmza_gdpr_company_name &name #2 &name &polyname #2 &polyname &address.


Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.


The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact


Multiple

Authenticated

Stored

Cross-Site

Scripting

(XSS)

vulnerabilities

in

YITH

Maintenance

Mode

(WordPress

plugin)

versions

there

are

vulnerable

parameters

that

were

missed

by

the

vendor

while

patching

the

version

to

Vulnerable

parameters:

\Newsletter\

tab

&yith_maintenance_newsletter_submit_label

parameter:

payload

should

start

with

a

single

quote

symbol

to

break

the

context

i.e.:

NOTIFY

ME'

autofocus

onfocus=alert(/Visse/);//

v='

this

payload

will

be

auto

triggered

while

admin

visits

this

page/tab.

\General\

tab

issues

vulnerable

parameters:

\Background\

tab

issues

vulnerable

parameters:

\Logo\

tab

issues

vulnerable

parameters:

&yith_maintenance_logo_tagline_fontfamily

&yith_maintenance_logo_tagline_fontcolor.

\Newsletter\

tab

issues

vulnerable

parameters:

&yith_maintenance_newsletter_email_fontsize

&yith_maintenance_newsletter_email_fontfamily

&yith_maintenance_newsletter_email_fontcolor

&yith_maintenance_newsletter_submit_fontsize

&yith_maintenance_newsletter_submit_fontfamily

&yith_maintenance_newsletter_submit_fontcolor

&yith_maintenance_newsletter_submit_background_hover

&yith_maintenance_newsletter_email_label

&yith_maintenance_newsletter_hidden_fields.

\Socials\

tab

issues

vulnerable

parameters:


Jenkins Scriptler Plugin 3.1 and earlier does not escape script content resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.


Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.


Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field.


SAP NetWeaver Enterprise Portal versions - 7.10 7.11 7.20 7.30 7.31 7.40 7.50 does not sufficiently encode user related data resulting in Stored Cross-Site Scripting (XSS) vulnerability. This would allow an attacker with administrative privileges to store a malicious script on the portal. The execution of the script content by a victim registered on the portal could compromise the confidentiality and integrity of portal content.


Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.


Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.


Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.


GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4 there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.


Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers the malicious code gets executed by the web browser in the context of the vulnerable application.


Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scripts.


SAP Commerce Cloud versions - 1808 1811 1905 2005 2011 allows an authenticated attacker to include invalidated data in the HTTP response Content Type header due to improper input validation and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks including cross-site scripting and page hijacking.


GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting attack. To exploit this endpoint attacker need to be authenticated. This is fixed in version 9.5.4.


Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides resulting in a reflected cross-site scripting (XSS) vulnerability.


Dell EMC SourceOne versions 7.2SP10 and prior contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit this vulnerability to hijack user sessions or to trick a victim application user to unknowingly send arbitrary requests to the server.


Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers the malicious code gets executed by the web browser in the context of the vulnerable application.


Wiki.js

an

open-source

wiki

app

built

on

Node.js.

Wiki.js

before

version

is

vulnerable

to

stored

cross-site

scripting

through

mustache

expressions

in

code

blocks.

This

vulnerability

exists

due

to

mustache

expressions

being

parsed

by

Vue

during

content

injection

even

though

it

is

contained

within

a

`<pre>`

element.

By

creating

a

crafted

wiki

page

a

malicious

Wiki.js

user

may

stage

a

stored

cross-site

scripting

attack.

This

allows

the

attacker

to

execute

malicious

JavaScript

when

the

page

is

viewed

by

other

users.

For

an

example

see

referenced

GitHub

Security

Advisory.

Commit

fixes

this

vulnerability

by

adding

the

v-pre

directive

to

all

`<pre>`

tags

during

the

render.


Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.


Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.


Magento versions 2.4.1 (and earlier) 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.


VMware Workspace one UEM console (2102 prior to 21.2.0.8 2101 prior to 21.1.0.14 2011 prior to 20.11.0.27 2010 prior to 20.10.0.16 2008 prior to 20.8.0.28 2007 prior to 20.7.0.14 2006 prior to 20.6.0.19 2005 prior to 20.5.0.46 2004 prior to 20.4.0.21 2003 prior to 20.3.0.23 2001 prior to 20.1.0.32 1912 prior to 19.12.0.24) contain a cross-site scripting vulnerability. VMware Workspace ONE UEM console does not validate incoming requests during device enrollment after leading to rendering of unsanitized input on the user device in response.


ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification the attacker could implement XSS attacks by tampering with the parameters to affect the operations of valid users. This affects: <ZXIPTV><ZXIPTV-EAS_PV5.06.04.09>


Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause resulting in a stored cross-site scripting (XSS) vulnerability.


Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.


Magento versions 2.4.1 (and earlier) 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.


Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.


Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users either via the security realm or directly inside Jenkins.


Flarum is an open source discussion platform for websites. The \Flarum Sticky\ extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through the m.trust() helper. This resulted in an HTML injection where <script> tags would not be executed. However it was possible to run javascript from other HTML attributes enabling a cross-site scripting (XSS) attack to be performed. Since the exploit only happens with the first post of a pinned discussion an attacker would need the ability to pin their own discussion or be able to edit a discussion that was previously pinned. On forums where all pinned posts are authored by your staff you can be relatively certain the vulnerability has not been exploited. Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history you cannot be certain if a malicious edit was reverted. The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension. Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.


Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.


TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51 8.7.40 9.5.25 10.4.14 11.1.1 it has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 7.6.51 8.7.40 9.5.25 10.4.14 11.1.1.


Jenkins 2.274 and earlier LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.


ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.


Adobe Coldfusion versions 2016 (update 16 and earlier) 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.


Jenkins 2.274 and earlier LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.


Bootstrap

Package

is

a

theme

for

It

has

been

discovered

that

rendering

content

in

the

website

frontend

is

vulnerable

to

cross-site

scripting.

A

valid

backend

user

account

is

needed

to

exploit

this

vulnerability.

Users

of

the

extension

who

have

overwritten

the

affected

templates

with

custom

code

must

manually

apply

the

security

fix.

Update

to

version

or

of

the

Bootstrap

Package

that

fix

the

problem

described.

Updated

version

are

available

from

the

extension

manager

Packagist

and

at


Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0 the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on but may allow access to cookies and other browser data CSRF vulnerabilities and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.


Magento versions 2.4.1 (and earlier) 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.


Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.


Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application.


TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 10.4.14 11.1.1.


Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.


TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14 11.1.1 it has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to exploit this vulnerability. This is fixed in versions 10.4.14 11.1.1 .


SAP BusinessObjects Business Intelligence platform versions 410 420 allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control which can be executed by User who views the relevant application content which leads to Stored Cross-Site Scripting.


Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint resulting in a reflected cross-site scripting (XSS) vulnerability.


TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28 10.0.0 through 10.4.17 and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for _backend layouts_ are not properly encoded the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29 10.4.18 11.3.1 contain a patch for this vulnerability.


Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.


TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28 10.0.0 through 10.4.17 and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29 10.4.18 11.3.1 contain a patch for this issue.


Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1 versions 2.12-2.12.4 and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock` `TextBlock` or a similar user-defined block derived from `FieldBlock`) and that block does not specify a template for rendering the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin). Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch) Wagtail 2.12.5 and Wagtail 2.13.2 (for the current 2.13 branch). As a workaround site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock such as a StructBlock are unaffected). In these cases the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`.


Datasette

is

an

open

source

multi-tool

for

exploring

and

publishing

data.

The

debugging

feature

in

Datasette

does

not

correctly

escape

generated

HTML

resulting

in

a

reflected

cross-site

vulnerability.

This

vulnerability

is

particularly

relevant

if

your

Datasette

installation

includes

authenticated

features

using

plugins

such

as

as

an

attacker

could

use

the

vulnerability

to

access

protected

data.

Datasette

and

both

include

patches

for

this

issue.

If

you

run

Datasette

behind

a

proxy

you

can

workaround

this

issue

by

rejecting

any

incoming

requests

with

or

in

their

query

string

parameters.


is

open-source

file

sharing

software.

In

before

commit

there

is

a

basic

cross-site

scripting

vulnerability

that

allows

an

attacker

to

inject

/<script>//code</script>

and

execute

JavaScript

code

on

the

client

side.


Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6 the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. Malicious authenticated Panel users can escalate their privileges if they get access to the Panel session of an admin user. Visitors without Panel access can use the attack vector if the site allows changing site data from a frontend form. Kirby 3.5.7 patches the vulnerability. As a partial workaround site administrators can protect against attacks from visitors without Panel access by validating or sanitizing provided data from the frontend form.


wire-webapp is the web version of Wire an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab (right click -> open in new tab or copy the URL and paste it in the URL bar) an the image payload is executed on the domain hosting the app (app.wire.com). In particular if an image contains malicious code in addition to the actual picture this code is executed on app.wire.com. This allows the attacker to fully control the user account. The vulnerability was patched in version 2021-06-01-production.0. As a workaround users should not try to open image URLs.


TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse sanitize and encode malicious rich-text content the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users no authentication is required. Update to TYPO3 versions 7.6.53 ELTS 8.7.42 ELTS 9.5.29 10.4.19 11.3.2 that fix the problem described.


Monkshu is an enterprise application server for mobile apps (iOS and Android) responsive HTML 5 apps and JSON API services. In version 2.90 and earlier there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a known bug in the server which will cause a 500 error and the response will then embed the URL provided by the hacker. The impact is moderate as the hacker must also be able to craft an HTTP request which should cause a 500 server error. None such requests are known as this point. The issue is patched in version 2.95. As a workaround one may use a disk caching plugin.


Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13 20.0.11 and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13 20.0.11 and 21.0.3. As a workaround use a browser that has support for Content-Security-Policy.


Special characters of IGT search function in igt+ are not filtered in specific fields which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS (Cross-site scripting) attacks.


** UNSUPPORTED WHEN ASSIGNED ** In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is completely resolved in new Ericsson library browsing tool ELEX used in systems like Ericsson Network Manager. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Ericsson Network Manager is a new generation OSS system which OSS-RC customers shall upgrade to.


TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28 10.0.0 through 10.4.17 and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29 10.4.18 11.3.1 contain a patch for this issue.


The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts in versions up to and including 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function low-level authenticated users such as subscribers can exploit this vulnerability.


A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php


The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts in versions up to and including 1.6.8.


SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the \Quick Prompt\ workflow.


A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php which allows an attacker to upload a SVG file containing malicious JavaScript code.


PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS) as demonstrated by the /server/ajax/events_manager.php title parameter. This can be exploited by an adversary in multiple ways e.g. to perform actions on the page in the context of other users or to deface the site.


It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability.


A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config and (2) index.php pages.


A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.


A

Cross

Site

Scripting

(XSS)

vulnerability

exists

in

Chikista

Patient

Management

Software

via

the

parameter

in

the

patient/insert

and

pages.


The

Asgaros

Forums

WordPress

plugin

is

vulnerable

to

Stored

Cross-Site

Scripting

due

to

insufficient

escaping

via

the

name

parameter

found

in

the

file

which

allowed

attackers

with

administrative

user

access

to

inject

arbitrary

web

scripts

in

versions

up

to

and

including

This

affects

multi-site

installations

where

is

disabled

for

administrators

and

sites

where

is

disabled.


Cross-site Scripting (XSS) vulnerability in the search functionality of AlCoda NetBiblio WebOPAC allows an unauthenticated user to craft a reflected Cross-Site Scripting attack. This issue affects: AlCoda NetBiblio WebOPAC versions prior to 4.0.0.320; versions later than 4.0.0.328. This issue does not affect: AlCoda NetBiblio WebOPAC version 4.0.0.335 and later versions.


A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box.


A

Cross

Site

Scripting

(XSS)

vulnerability

exists

in

Chikista

Patient

Management

Software

in

the

parameter

in

patient/insert

and

pages.


The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page leading to a Reflected Cross-Site Scripting


The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page leading to a Reflected Cross-Site Scripting


The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly therefore any user even unauthenticated could cause arbitrary javascript to be executed in the admin panel.


In OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.


The Contact Form Entries WordPress plugin before 1.1.7 does not validate sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry


The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages leading to Reflected Cross-Site Scripting issues


The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement leading to a SQL injection which can also be exploited to cause a Reflected Cross-Site Scripting issue


The

Duplicate

Page

or

Post

WordPress

plugin

before

does

not

have

any

authorisation

and

has

a

flawed

CSRF

check

in

the

wpdevart_duplicate_post_parametrs_save_in_db

AJAX

action

allowing

any

authenticated

users

such

as

subscriber

to

call

it

and

change

the

plugin's

settings

or

perform

such

attack

via

CSRF.

Furthermore

due

to

the

lack

of

escaping

this

could

lead

to

Stored

Cross-Site

Scripting

issues


Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/.


The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response leading to Reflected Cross-Site Scripting issues


The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.


The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field \Custom Patreon Page name\ which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page leading to a Reflected Cross-Site Scripting


The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.


The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The KingComposer WordPress plugin through 2.9.6 does not have authorisation CSRF and sanitisation/escaping when creating profile allowing any authenticated users to create arbitrary ones with Cross-Site Scripting payloads in them


The Portfolio Gallery Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions allowing any authenticated users such as subscriber to call them. Due to the lack of sanitisation and escaping it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed


The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value available to admin users this can only be exploited by an admin against another admin user.


Nagios

XI

version

is

affected

by

cross-site

scripting

(XSS).

The

vulnerability

exists

in

the

file

due

to

improper

sanitization

of

user-controlled

input.

A

maliciously

crafted

URL

when

clicked

by

an

admin

user

can

be

used

to

steal

his/her

session

cookies

or

it

can

be

chained

with

the

previous

bugs

to

get

one-click

remote

command

execution

(RCE)

on

the

Nagios

XI

server.


The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page leading to a Reflected Cross-Site Scripting


** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched.


The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action allowing any authenticated users such as subscribers to call them. Furthermore due to the lack of sanitisation it also lead to Stored Cross-Site Scripting issues


The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Affiliates Manager WordPress plugin before 2.9.0 does not validate sanitise and escape the IP address of requests logged by the click tracking feature allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.


The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin page leading to a Reflected Cross-Site Scripting


The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard leading to a Reflected Cross-Site Scripting


The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the \visibility\ parameter.


The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload.


The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard leading to a Reflected Cross-Site Scripting issue


The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action


** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched.


The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action leading to a Reflected Cross-Site Scripting


The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages leading to Reflected Cross-Site Scripting issues


In OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since the function `validateFormInput()` performs improper validation checks on the input sent to the `userID` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.


The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page leading to a Reflected Cross-Site Scripting


The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard leading to a Reflected Cross-Site Scripting issue


OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues.


The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard leading to a Reflected Cross-Site Scripting


In ArangoDB versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS) since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set which makes it more susceptible for leveraging self XSS by attackers.


The CLUEVO LMS E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page leading to a Reflected Cross-Site Scripting


The Privacy Policy Generator Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings allowing any authenticated users such as subscriber to update them. Furthermore due to the lack of sanitisation and escaping it could lead to Stored Cross-Site Scripting


The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled leading to a Reflected Cross-Site Scripting issue


The Image Hover Effects Ultimate (Image Gallery Effects Lightbox Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page leading to a Reflected Cross-Site Scripting


The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate sanitise and escape the redirect_to parameter before using it to redirect user either via a Location header or meta url attribute when the Rename Login Page is active which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known which should be hard to guess reducing the risk


The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.


The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page leading to a Reflected Cross-Site Scripting


In Django-wiki versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application the payload in the notification panel renders and loads external JavaScript.


The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes leading to a Reflected Cross-Site Scripting issue


The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response leading to a Reflected Cross-Site Scripting issue


In Shuup versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.


Magnolia

CMS

from

to

contains

a

stored

cross-site

scripting

(XSS)

vulnerability

in

the

mgnlUserId

parameter.


The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes leading to Reflected Cross-Site Scripting issues


The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files allowing attacker to make a logged In admin import arbitrary snippets. Furthermore imported snippers are not sanitised and escaped which could lead to Stored Cross-Site Scripting issues


The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page leading to a Reflected Cross-Site Scripting


The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard leading to an SQL injection. Due to the lack of sanitisation and escaping this could also lead to Reflected Cross-Site Scripting


The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard leading to a Reflected Cross-Site Scripting


The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page allowing an attacker to perform such attack against any logged in users


In OpenNMS Horizon versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.


The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action allowing any authenticated users such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.


In OpenNMS Horizon versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.


The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action allowing any authenticated user to call it or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore due to the lack of validation sanitisation and escaping users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin


The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes leading to Reflected Cross-Site Scripting issues


Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column.


The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message leading to a Reflected Cross-Site Scripting


The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping it could also lead to Stored Cross-Site Scripting issues


The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes leading to Reflected Cross-SIte Scripting issues


The Advanced Page Visit Counter WordPress plugin through 5.0.8 does not sanitise and escape some input before outputting it in an admin dashboard page allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it


The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page leading to a Reflected Cross-Site Scripting issue


In OpenNMS Horizon versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting since the function `add()` performs improper validation checks on the input sent to the `foreign-source` parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.


The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page leading to a Reflected Cross-Site Scripting


The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page leading to a Reflected Cross-Site Scripting


The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin


The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled leading to a Reflected Cross-Site Scripting issue


The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting it back in the page leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCE_SALT and NONCE_KEY


A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.


The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the wp_user shortcode is used leading to Reflected Cross-Site Scripting issues


The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.


The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors both via a similar method.


The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf *_flakes_leaf *_speed) which could lead to Stored Cross-Site Scripting issues


The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The User Registration Login Form User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page leading to a Reflected Cross-Site Scripting issue


The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action leading to a Reflected Cross-site Scripting (XSS) vulnerability.


The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the \extension\ parameter in the Extensions dashboard which is output in an attribute without being escaped first. This could allow an attacker who can convince an authenticated admin into clicking a link to run malicious JavaScript within the user's web browser which could lead to full site compromise.


The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic allowing high privilege users such as admin to use XSS payload in it leading to an authenticated Stored Cross-Site Scripting issue


The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action allowing any authenticated users to call it. Due to the lack of sanitisation and escaping users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins


The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions allowing any user to call them and add/edit/delete Surveys. Furthermore due to the lack of sanitization in the Surveys' Title this could also lead to Stored Cross-Site Scripting issues


The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter leading to reflected Cross-Site Scripting issue


The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard such as the email's id subject and recipient which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.


The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the \Logo Margin\ carousel option which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks


The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages leading to Reflected Cross-Site Scripting issues


The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks


In the YOP Poll WordPress plugin before 6.2.8 when a pool is created with the options \Allow other answers\ \Display other answers in the result list\ and \Show results\ it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected which could be before or after sending the vote for example.


The Contact Form Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute leading to a Reflected Cross-Site Scripting issue


The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings which could lead to a Stored Cross-Site Scripting issue.


The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).


The Migration Backup Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page leading to a Stored Cross-Site Scripting issue


The Realteo WordPress plugin before 1.2.4 used by the Findeo Theme did not properly sanitise the keyword_search search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page leading to an unauthenticated reflected Cross-Site Scripting issue.


The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings nor sanitise and escape some of them which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks


The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The WordPress File Upload WordPress plugin before 4.16.3 wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks


The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page leading to an authenticated stored Cross-Site Scripting issue


The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.


The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.


The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed


The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page leading to a reflected Cross-Site Scripting issue


The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the \Enable 'More' icon\ option is enabled (which is the default setting) leading to a Reflected Cross-Site Scripting issue.


The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label results link label and back to vote caption label.


The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user) does not validate user input before passing it to unserialize() nor sanitise and escape it before outputting it in the response. As a result it could allow users with a role as low as Subscriber to perform PHP Object Injection as well as Stored Cross-Site Scripting attacks


The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks


The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages leading to Reflected Cross-Site Scripting issues


The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.


The Forms WordPress plugin before 1.12.3 did not sanitise its input fields leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms \Add new\ field.


The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page leading to a Reflected Cross-Site Scripting


The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block leading to a Reflected Cross-Site Scripting issue.


Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin versions before 5.16.5 did not sanitise the mic_comment field (Notes on time) when adding/editing an event allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them which will be triggered in the frontend when viewing the event.


The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings which could allow high privilege users to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.


The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its \php_id\ setting before outputting it back in an attribute in the page leading to a stored Cross-Site Scripting issue.


The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks


The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.


The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) \color\ or \css_class\ argument of sdm_download shortcode 2) \class\ or \placeholder\ argument of sdm_search_form shortcode.


The WP Google Maps WordPress plugin before 8.1.12 did not sanitise validate of escape the Map Name when output in the Map List of the admin dashboard leading to an authenticated Stored Cross-Site Scripting issue


The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word) outputting it in an attribute after sanitising it to remove HTML tags which is not sufficient and lead to a reflected Cross-Site Scripting issue.


The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder.


The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide \Title\ \Description\ and Gallery \Title\ fields which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed


The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute leading to a reflected Cross-Site Scripting issue


The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the \Footer Credit Text\ added to pages allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.


The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey


The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard leading to an Unauthenticated Stored Cross-Site Scripting issue


The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes allowing users with a role as low as contributor to perform Cross-Site Scripting attacks


The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in other setting options allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its \Consumer key\ setting before outputting it its settings page leading to a Stored Cross-Site Scripting issue.


The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page leading to a Reflected Cross-Site Scripting issue


Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin versions before 1.1.6 lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded which could lead to privilege escalation.


The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action) nor sanitise and escape them before outputting them in the admin dashboard which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.


The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting issue


The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard leading to a Reflected Cross-Site Scripting


The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page leading to an authenticated Stored Cross-Site Scripting issue


The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute leading to a Reflected Cross-Site Scripting


The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its \Use your own \ setting before outputting it in the page leading to an authenticated (admin+) stored Cross-Site Scripting issue


The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed


The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action as well as do not sanitise and escape some of the data submitted. As a result any authenticated such as subscriber could update the plugin's settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend


The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin versions before 3.4.3 lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.


The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard which could lead to a Reflected Cross-Site Scripting issue


The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode


The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context


The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or escaped before being output in an attribute.


The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute leading to a reflected Cross-Site Scripting issue in the update settings page.


The WP System Log WordPress plugin before 1.0.21 does not sanitise validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs.


The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard leading to a Reflected Cross-Site Scripting issue


The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page leading to a Reflected Cross-Site Scripting issue


The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins


The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings and did not sanitise as well as escape some of them which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks


The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks


The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes leading to Stored Cross-Site Scripting issues


The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute leading to a Reflected Cross-Site Scripting issue in an admin page


The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php) leading to a reflected Cross-Site Scripting issue.


The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.


The NEX-Forms WordPress plugin through 7.9.4 does not escape some of its settings and form fields before outputting them in attributes which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action available to any authenticated user and does not escape some of the settings. As a result any authenticated user such as subscriber could update the plugin's settings and put Cross-Site Scripting payloads in them


The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet allowing high privilege users to add JavaScript in them leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in the admin dashboard


The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page leading to a Stored Cross-Site Scripting issue. By default only administrator users could access the affected functionality limiting the exploitability of the vulnerability. However some WordPress admins may allow lesser privileged users to access the plugin's functionality in which case privilege escalation could be performed.


The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode) as well as the Text Preview field of a Project (injected on the edit project page)


The Coming Soon Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled even when the unfiltered_html capability is disallowed leading to an authenticated Stored Cross-Site Scripting issue


The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content) align color variant and fontID argument of a Gutenberg block.


The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks


The Contact Form Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The

Bello

Directory

Listing

WordPress

theme

before

did

not

properly

sanitise

and

escape

its

bt_bb_listing_field_location_autocomplete

and

parameter

in

ints

listing

page

leading

to

reflected

Cross-Site

Scripting

issues.


The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.


The Special Text Boxes WordPress plugin through 5.9.109 does not sanitise or escape some of its settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.


The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute leading to a reflected Cross-Site Scripting issue


The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments leading to a Stored Cross-Site Scripting issue.


The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings allowing high privilege users to use JavaScript in them which will be output in the page leading to an authenticated Stored Cross-Site Scripting issue


The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions allowing any authenticated users to call then which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.


The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.


The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed


The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit allowing high privilege users to set JavaScript payloads in them even when he unfiltered_html capability is disallowed leading to an authenticated Stored Cross-Site Scripting issue


The \All Subscribers\ setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.


The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response leading to a Reflected Cross-Site Scripting issue


The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action leading to an unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability.


The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute leading to a Reflected Cross-Site Scripting issue


The MF Gig Calendar WordPress plugin through 1.1 does not sanitise or escape the id GET parameter before outputting back in the admin dashboard when editing an Event leading to a reflected Cross-Site Scripting issue


Unvalidated input and lack of output encoding in the Team Members WordPress plugin versions before 5.0.4 lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker (contributor+) to inject arbitrary web script or HTML via the 'Description/biography' of a member.


The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*) leading to a Reflected Cross-Site Scripting (XSS) issue.


The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes leading to Reflected Cross-Site Scripting issues


The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled leading to a Reflected Cross-Site Scripting


Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin versions before 1.8.8 lead to multiple Stored Cross-Site Scripting vulnerabilities which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.


The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue


The Popups Welcome Bar Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attribute leading to a reflected Cross-Site Scripting issue


The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks


The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields it could also lead to Stored Cross-Site Scripting issues


The Yada Wiki WordPress plugin before 3.4.1 did not sanitise validate or escape the anchor attribute of its shortcode leading to a Stored Cross-Site Scripting issue


The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name allowing high privilege users such as admin to set Cross-Site Scripting payload in them even when the unfiltered_html capability is disallowed


The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.


The Newsletter SMTP Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute leading to a Reflected Cross-Site Scripting issue


The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors all via a similar method.


The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard leading to an authenticated Stored Cross-Site Scripting issue.


The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute leading to a Reflected Cross-Site Scripting


The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings as well as does not sanitise and escape them which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)


The User Registration Login Form User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute leading to a Reflected Cross-Site Scripting issue


The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed leading to an authenticated Stored Cross-Site Scripting issue


The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition one of the endpoint could be used to set CSS code if a setting is enabled which will then be output in some pages without being sanitised and escaped. Combining those two issues an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.


The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.


The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize validate or escape the 'id' parameter before outputting back in the page leading to a reflected Cross-Site Scripting issue.


The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.


The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message\ setting when outputting it in the backend and frontend leading to an Authenticated Stored Cross-Site Scripting issue


The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page leading to a Cross-Site Scripting issue


The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed


The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed


The YouTube Embed Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape validate or sanitise some of its shortcode options available to users with a role as low as Contributor leading to an authenticated Stored Cross-Site Scripting issue.


The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page leading to a Reflected Cross-Site Scripting issue


The VM Backups WordPress plugin through 1.0 does not have CSRF checks allowing attackers to make a logged in user unwanted actions such as update the plugin's options leading to a Stored Cross-Site Scripting issue.


Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin version 1.6.3 and below leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.


The WordPress File Upload WordPress plugin before 4.16.3 wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files which could be then be used for Cross-Site Scripting attacks


The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its \Paypal email address\ setting before outputting it in the page leading to an authenticated Stored Cross-Site Scripting issue


The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboard allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed


The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks


The WordPress Advanced Ticket System Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page leading to an authenticated reflected Cross-Site Scripting issue


The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute leading to a Reflected Cross-Site Scripting in the admin dashboard