WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 44.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin WPO365 versions = 44.1...

WordPress Email Marketing for WordPress and WooCommerce – Retainful plugin <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Trithem in WordPress Plugin Email Marketing for WordPress and WooCommerce – Retainful versions = 1.0.10...

WordPress FunnelKit – Funnel Builder for WooCommerce Checkout plugin <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Funnel Builder by FunnelKit versions = 3.16.0.5...

WordPress Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Molongui versions = 5.2.12...

WordPress Motors – Car Dealership & Classified Listings Plugin plugin <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Kamil B. in WordPress Plugin Motors versions = 1.4.123...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...

NoXss

NoXss NoXss is a cross-site script vulnerability scanner supported reflected xss and dom-based xss. It's very fast and suitable for testing millions of urls. It has found some xss vulnerabilities in Bug Bounty program. Features Fast and suitable for testing millions of urls Support Dom-based xssu...

WordPress WP Meteor Website Speed Optimization Addon plugin <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin WP Meteor Page Speed Optimization Topping versions = 3.4.18...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPDM – Premium Packages versions = 7.2.6...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.2.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Contact Form by WPForms versions = 2.0.2.1...

CVE-2024-25503

CVE-2024-25503 نوع الثغرة: البرمجة النصية عبر المواقع XSS المنتج: تطبيق Advanced REST Client لسطح المكتب الإصدار المعرض للخطر: 17.0.9 بائع المنتجات:https://www.advancedrestclient.com/ 1. الوصف تسمح ثغرة البرمجة النصية عبر المواقع XSS في Advanced REST Client الإصدار 17.0.9 لمهاجم عن بُعد بتنفيذ...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP User Frontend versions = 4.3.12...

WordPress WP Photo Album Plus plugin <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin WP Photo Album Plus versions = 9.3.03.002...

WordPress PeproDev Ultimate Profile Solutions plugin <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin PeproDev Ultimate Profile Solutions versions = 8.2.36...

CVE-2025-46173

CVE-2025-46173 - ثغرة تخزين سكربتات عبر المواقع XSS في Online Exam Mastering System 1.0 📌 الملخص CVE-2025-46173 هي ثغرة تخزين سكربتات عبر المواقع XSS تم اكتشافها في Online Exam Mastering System 1.0 من code-projects. توجد الثغرة في مكوّن feedback.php حيث لا يتم تطهير إدخال المستخدم في حقل الاسم بش...

snuck

snuck Automatic XSS filter bypass Overview snuck is an automatic tool whose goal is to significantly test a given XSS filter by specializing the injections on the basis of the reflection context. This approach adopts Selenium to drive a web browser in reproducing both the attacker and the victim...

snuck

snuck تجاوز تلقائي لمرشح XSS نظرة عامة snuck هي أداة تلقائية تهدف إلى اختبار مرشح XSS معين بشكل كبير من خلال تخصيص الحقن بناءً على سياق الانعكاس. يعتمد هذا النهج على Selenium لقيادة متصفح ويب في إعادة إنتاج سلوك المهاجم والضحية. تعرف على snuck قم بزيارة البرنامج التعليمي لمزيد من المعلومات حول...

CVE-2021-38699-Stored-XSS

CVE-2021-38699: XSS مخزّن في TastyIgniter v3.0.7 Restaurtant CMS يوجد نص برمجي مخزّن عبر المواقع XSS مصادق عليه في قسم سجلات النظام System Logs في تطبيق الويب TastyIgniter v3.0.7 Restaurtant CMS. https://vulners.com/cve/CVE-2021-38699 POC 1. قم بتنفيذ نص برمجي عكسي عبر المواقع XSS في مكان آخر في...

CVE-2026-107845 Contao: Cross-site scripting in the comments bundle

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...

EUVD-2026-95975

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...