CVE-2026-92538 LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-91895

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.4.7 ) is vulnerable to Reflected DOM-Based Cross-Site Scripting . The flaw exists in the 'orderby' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbit...

CVE-2022-45472

CVE-2022-45472 基于DOM的XSS 软件：CAE Learning Space Enterprise（含Intuity许可证） 镜像版本：267r 补丁级别：639 漏洞：基于DOM的XSS 描述 CAE Learning Space Enterprise 管理软件容易受到基于DOM的XSS攻击。基于DOM的XSS攻击是指用户向主机发送一个可执行的载荷，从而在受害者的浏览器中从原始客户端脚本修改DOM环境。该攻击是通过手动搜索Burp请求，使用名为Dalfox https://github.com/hahwul/dalfox...

CVE-2020-11023

CVE-2020-11023 POC DOM XSS 此概念验证演示了基于DOM的XSS安全漏洞，通过操纵和使用jQuery DOM方法实现，例如：.append, .text, .html 我使用的Payload： alert"Text: " + $"test".text; 测试该漏洞，请执行以下步骤： 1. 在浏览器中打开目标网站的控制台。 2. 进入控制台窗口并输入以下Payload： 3. Payload: alert"Text: " + $"test".text;...

CVE-2026-85492

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

CVE-2026-85492 All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

EUVD-2026-91336

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

findom-xss

FinDOM-XSS FinDOM-XSS 是一个工具，可以快速查找可能的/潜在的基于DOM的XSS漏洞。 安装 $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules 依赖项： LinkFinder 用法 要在目标上运行该工具，只需使用以下命令。 $ ./findom-xss.sh https://domain.tld/about-us.html 这将对 domain.tld 运行该工具。 URLs也可以管道输入到findom-xss并进行扫描。例如： $ cat urls.txt |...

findom-xss

FinDOM-XSS FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner. Installation $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencies: LinkFinder Usage To run the tool on a target, just use the...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Explotación de XSS DOM en Roundcube Webmail 📋 Información del Exploit Título del Exploit: XSS DOM en Roundcube Webmail mediante href SVG CVE-2026-25916 Autor: Mohammed Idrees Banyamer Contacto: GitHub @mbanyamer | Instagram @banyamersecurity País: Jordania Fecha: 9 de febrero de...

CVE-2024-28715

CVE-2024-28715 CVE 编号 CVE-2024-28715 产品 DoraCMS 版本 DoraCMS v2.18 及更早版本 问题类型 基于DOM的XSS 描述 DOraCMS v.2.18 及更早版本中存在跨站脚本漏洞，允许远程攻击者通过 /app/public/apidoc/oas3/wrap-components/markdown.jsx 端点中的 markdown0 函数执行任意代码。 使用方式 https://target-site/static/apidoc/index.html?url=https://your-site/POC.yaml...

CVE-2025-65442-DOM-based-Cross-Site-Scripting-XSS-Vulnerability-in-novel-V3.5.0-CWE-79-

Objetivo:http://117.72.165.13:8888/ Github:https://github.com/201206030/novel Versión:V3.5.0 Nombre de la vulnerabilidad:Vulnerabilidad de Cross-Site Scripting XSS basado en DOM en novel V3.5.0 CWE-79 Tipo de vulnerabilidad: Cross-Site Scripting basado en DOM DOM-based XSS Fecha de descubrimiento...

WordPress Appointment Hour Booking – Booking Calendar plugin <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Zackary Loevseth in WordPress Plugin Appointment Hour Booking versions = 1.5.97...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...

WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Muhamad Visat in WordPress Plugin Social Media & Share Icons versions = 3.0.1...

CVE-2026-100179

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x any URL parameter consumed by the form's calculated equation' parameter in all versions up to, and including,...

CVE-2026-100184

The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.3 . The root cause is insufficient input sanitization and output escaping of the x parameter, where the name corresponds to t...

EUVD-2026-90570

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...

CVE-2026-100184 Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...