golang: html/template: improper handling of special tags within script contexts

A flaw was found in Golang. The html/template package did not apply the proper rules for handling occurrences of " contexts. This issue may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped...

golang: html/template: improper handling of HTML-like comments within script contexts

A flaw was found in Golang. The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This issue may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped...

PT-2023-31773 · WordPress · Idbbee

Name of the Vulnerable Software and Affected Versions: idbbee plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'idbbee' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-31976 · WordPress · Fareharbor

Name of the Vulnerable Software and Affected Versions: FareHarbor plugin for WordPress versions up to, and including, 3.6.7 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. This...

PT-2023-29778 · WordPress · Slimstat Analytics

Name of the Vulnerable Software and Affected Versions: Slimstat Analytics plugin for WordPress versions up to, and including, 5.0.9 Description: The issue is related to Stored Cross-Site Scripting via the 'slimstat' shortcode due to insufficient input sanitization and output escaping on...

CVE-2023-0439 NEX-Forms < 8.4.4 - Authenticated Stored XSS

The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins in multisite / admins in single site can create forms, however there is a settings allowing them to give lower roles access to such featur...

Cross site scripting

The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting...

PT-2023-21670 · WordPress · Crm Perks Forms

Name of the Vulnerable Software and Affected Versions: CRM Perks Forms plugin for WordPress versions up to, and including, 1.1.1 Description: The issue arises from insufficient input sanitization and output escaping in form settings, allowing authenticated attackers with administrator-level...

PT-2023-16597 · WordPress · The Pickup | Delivery | Dine-In Date Time Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Pickup | Delivery | Dine-in date time WordPress plugin versions 1.0.0 through 1.0.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capabili...

PT-2023-16119 · WordPress · Wp Google Review Slider

Name of the Vulnerable Software and Affected Versions: WP Google Review Slider versions prior to 11.8 Description: The issue arises from improper sanitization and escaping of a parameter before its use in a SQL statement, resulting in a SQL injection that can be exploited by users with a role as...

CVE-2022-2546

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...

Cross-site Scripting (XSS)

Overview oxidized-web is a puma+sinatra+haml webUI + REST API for oxidized Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper escape of user input provided to the toresearch argument in web/views/confsearch.haml. Details Cross-site scripting or XSS is a...

CVE-2022-3074 Slider Hero < 8.4.4 - Admin+ Stored Cross-Site Scripting

The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks...

WordPress plugin Auto More Tag 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2022-34911

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is...

CVE-2022-1528

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...

GHSA-H8QX-MJ6V-2934 MediaWiki Cross-site Scripting (XSS) vulnerability

An issue was discovered in MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3. The non-jqueryMsg version of mw.message.parse doesn't escape HTML. This affects both message contents which are generally safe and the parameters which can be based on user input. When jqueryMsg is loaded,...

Jenkins Multiselect parameter Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. Jenkins Multiselect parameter Plugin 1.3 and earlier versions have a cross-si...

PT-2022-20421 · Jenkins · Jenkins Promoted Builds (Simple) Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Promoted Builds Simple Plugin versions 1.9 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the name and description of Promotion Level parameters on views displaying...

CVE-2022-30241

The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...