Cross site scripting

The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

PT-2021-22057

Name of the Vulnerable Software and Affected Versions: Border Loading Bar WordPress plugin versions up to and including 1.0.1 Description: The issue allows attackers to inject arbitrary web scripts via Reflected Cross-Site Scripting, utilizing the f and t parameters found in the...

CVE-2021-38338: Improper Neutralization of Input During Web Page Generation

The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

Border Loading Bar <= 1.0.1 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts...

CVE-2021-24435

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues...

CVE-2021-24435: Improper Neutralization of Input During Web Page Generation

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues...

PT-2021-15963

Name of the Vulnerable Software and Affected Versions titan-framework affected versions not specified Description The issue concerns the iframe-font-preview.php file, which fails to properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute. Th...

CVE-2021-34649: Improper Neutralization of Input During Web Page Generation

The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dark parameter in the /titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2...

PT-2021-4128

Name of the Vulnerable Software and Affected Versions Simple Behance Portfolio WordPress plugin versions up to and including 0.2 Description The issue allows attackers to inject arbitrary web scripts via the dark parameter in the /titan-framework/iframe-font-preview.php file. This is a Reflected...

Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)

Description The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues Edit WPScanTeam: - The original report mentioned the issue...

CVE-2021-22871

Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting XSS vulnerability...

PT-2021-15244

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 5.1.0 Description The issue allows any user with a manager account to store possibly malicious content in the URL website property. This content is then displayed unsanitized in the affiliate-preview.php tag...

CVE-2021-22871: Improper Neutralization of Input During Web Page Generation

Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting XSS vulnerability...

CVE-2016-11005

The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?clientid= XSS...

CVE-2016-11005: Improper Neutralization of Input During Web Page Generation

The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?clientid= XSS...

PT-2019-7798

Name of the Vulnerable Software and Affected Versions instalinker plugin versions prior to 1.1.2 Description The issue concerns a problem with the instalinker plugin, where the includes/instalinker-admin-preview.php endpoint is vulnerable to XSS attacks when the client id parameter is used...

CVE-2016-10957

The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter...

CVE-2016-10957

The CVE-2016-10957 entry relates to the Akal WordPress theme (premium) and describes a Reflected/XSS vulnerability in the preview.php endpoint under framework/brad-shortcodes/tinymce, exploitable via the sc parameter. Multiple connected documents corroborate an XSS flaw affecting Akal up to 2016-...

PT-2019-7750

Name of the Vulnerable Software and Affected Versions Akal theme for WordPress versions through 2016-08-22 Description The issue concerns a cross-site scripting XSS problem. It is related to the sc parameter in the framework/brad-shortcodes/tinymce/preview.php file. Recommendations For Akal theme...

CVE-2016-10957: Improper Neutralization of Input During Web Page Generation

The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter...