CVE-2017-18494

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues...

CVE-2017-18494

The CVE-2017-18494 issue affects the WordPress plugin custom-search-plugin prior to version 1.36 (BestWebSoft). The connected Nuclei template and related records confirm multiple XSS vulnerabilities in this plugin, enabling an attacker (with no special privileges) to inject and execute arbitrary ...

CVE-2017-18494: Improper Neutralization of Input During Web Page Generation

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues...

CVE-2014-8320

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...

Cross site scripting

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...

CVE-2014-8320

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...

CVE-2014-8320

The CVE-2014-8320 entry concerns Drupal's Custom Search module (6.x-1.x prior to 6.x-1.12 and 7.x-1.x prior to 7.x-1.14). The vulnerability is an XSS flaw where remote authenticated users with certain permissions can inject arbitrary web script or HTML via the "Label text" field on the results co...

CVE-2014-8320: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...

CVE-2014-8745

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label...

Cross site scripting

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label...

CVE-2014-8745

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label...

CVE-2014-8745

The CVE-2014-8745 issue affects Drupal via the contributed Custom Search module (versions 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15). The root cause is an unsanitized taxonomy vocabulary label displayed by the module, enabling Cross-Site Scripting (XSS). Exploitation requires remote aut...

CVE-2014-8745: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label...

CVE-2014-7870

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to...

Cross site scripting

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to...

CVE-2014-7870

CVE-2014-7870 is a Drupal XSS vulnerability in the Custom Search module. Affected: Custom Search 6.x-1.x < 6.x-1.12 and 7.x-1.x

CVE-2014-7870: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to...

SA-CONTRIB-2014-043 - Custom Search - Cross Site Scripting (XSS)

The Custom Search module alters the default search box to provide some options like in advanced search, but directly in the search box. The module doesn't sanitize taxonomy vocabulary labels before display leading to a persistent cross site scripting XSS vulnerability. This vulnerability is...

Drupal 7.26 Custom Search 7.x-1.13 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vulnerability Report Author: Justin C. Klein Keane Reported: 19 Feb, 2014 Description of Vulnerability: - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL. The Custom Search modu...

SA-CONTRIB-2014-034 - Custom Search - Cross Site Scripting

The Custom Search module alters the default search box to provide additional search filtering options and control. Custom Search contains a persistent cross-site scripting XSS vulnerability due to the fact that it fails to sanitize filter labels before display. This vulnerability is mitigated by...