CVE-2026-13440 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'messagepopup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and...

CVE-2026-13440 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'messagepopup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and...

WordPress Finder - Cross-Site Scripting Detection

WordPress Plugin Finder contains a cross-site scripting vulnerability via the order parameter. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and laun...

YesWiki <2022-07-07 - Cross-Site Scripting Detection

YesWiki before 2022-07-07 contains a cross-site scripting vulnerability via the id parameter in the AccueiL URL. !/usr/bin/env python3 -- coding: utf-8 -- """YesWiki before 2022-07-07 contains a cross-site scripting vulnerability via the id parameter in the AccueiL UR.""" from kittysploit import...

WordPress PayPal Pro <1.1.65 - SQL Injection Detection

WordPress PayPal Pro plugin before 1.1.65 is susceptible to SQL injection via the 'query' parameter which allows for any unauthenticated user to perform SQL queries with the results output to a web page in JSON format. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress PayPal Pro plugin befor...

TileServer GL <=3.0.0 - Cross-Site Scripting Detection

TileServer GL through 3.0.0 is vulnerable to reflected cross-site scripting via server.js because the content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page. !/usr/bin/env python3 -- coding: utf-8 -- """TileServer GL through 3.""" from...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting Detection

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. !/usr/bin/env python3 -- coding: utf-8 -- """Agentejo...

TikiWiki CMS Groupware v8.3 - Open Redirect Detection

tiki-featuredlink.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection !/usr/bin/env python3 -- coding: utf-8 -- """tiki-featuredlink.""" import re from kittysploit import fr...

Apache Struts2 S2-012 RCE Detection

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts Showcase App...

BlogEngine.NET 3.3.7.0 - Local File Inclusion Detection

BlogEngine.NET 3.3.7.0 allows /api/filemanager local file inclusion via the path parameter !/usr/bin/env python3 -- coding: utf-8 -- """BlogEngine.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Gridx 1.3 - Remote Code Execution Detection

Gridx 1.3 is susceptible to remote code execution via tests/support/stores/testgridfilter.php, which allows remote attackers to execute arbitrary code via crafted values submitted to the $query parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gridx 1.""" from kittysploit import from...

ThinkAdmin 6 - Local File Inclusion Detection

ThinkAdmin version 6 is affected by a local file inclusion vulnerability because an unauthorized attacker can read arbitrary files on a remote server via GET request encode parameter. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkAdmin version 6 is affected by a local file inclusion...

Cyberoam NetGenie Cross-Site Scripting Detection

Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected cross-site scripting via the 'u' parameter of ft.php. !/usr/bin/env python3 -- coding: utf-8 -- """Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected...

WordPress True Ranker <2.2.4 - Local File Inclusion Detection

WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file via local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

Purchase Order Management v1.0 - SQL Injection Detection

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/viewdetails.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is...

Art Gallery Management System Project v1.0 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar. !/usr/bin/env python3 -- coding: utf-8 ...

Quick Event Manager < 9.7.5 - Cross-Site Scripting Detection

The Quick Event Manager WordPress Plugin, version 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qemajaxcalendar' action. !/usr/bin/env python3 -- coding: utf-8 -- """The Quick Event Manager WordPress Plugin, version 9.""" from kittysploit...

PMB 7.4.6 - Cross-Site Scripting Detection

PMB 7.4.6 contains a cross-site scripting vulnerability via the query parameter at /admin/convert/exportz3950new.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticatio...

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting Detection

Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the indexen.php 'from' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Parallels H-Sphere 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

Admidio - Cross-Site Scripting Detection

A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The reflected cross-site scripting vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious...