WordPress Visitor Traffic Real Time Statistics plugin <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Visitors Traffic Real Time Statistics versions = 8.16...

CVE-2021-42558

CVE-2021-42558: Múltiples Cross-Site Scripting en MITRE Caldera Caldera versiones =2.8.1 contiene múltiples vulnerabilidades XSS reflejadas, almacenadas y propias que pueden ser explotadas por atacantes autenticados y no autenticados. Divulgación del proveedor: La divulgación del proveedor para...

CVE-2026-97341

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...

EUVD-2026-91920

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-97341

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting in all versions up to and including 8.16 . The root cause is insufficient input sanitization and output escaping when handling the 'X-Real-IP' HTTP header. Specifically, the wp_aja...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538 LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-91895

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.4.7 ) is vulnerable to Reflected DOM-Based Cross-Site Scripting . The flaw exists in the 'orderby' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbit...

CVE-2026-92538: Improper Neutralization of Input During Web Page Generation

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-97341: Improper Neutralization of Input During Web Page Generation

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103909: Improper Neutralization of Input During Web Page Generation

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url. ' parameter in all versions up to, and including, 5.5.1.5 du...

CVE-2022-45472

CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Image Version: 267r Patch Level: 639 Vulnerability: DOM Based XSS Description The CAE Learning Space Enterprise management software is vulnerable to a DOM Based XSS attack. A DOM Based XSS attack is when a...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS Esta prueba de concepto demuestra una falla de seguridad de XSS basado en DOM manipulando y usando métodos DOM de JQuery. ej:.append, .text,.html Payload que usé: alert"Text: " + $"test".text; Para probar la vulnerabilidad, haz lo siguiente: 1. Abre la consola web de tu...

CVE-2026-85492

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

CVE-2026-85492 All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

EUVD-2026-91336

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

findom-xss

FinDOM-XSS FinDOM-XSS es una herramienta que te permite encontrar posibles y/o potenciales vulnerabilidades DOM based XSS de manera rápida. Instalación $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencias: LinkFinder Uso Para ejecutar la herramienta en un...