CVE-2024-0233: Improper Neutralization of Input During Web Page Generation

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-0187: Improper Neutralization of Input During Web Page Generation

The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-52198

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michiel van Eerd Private Google Calendars allows Stored XSS.This issue affects Private Google Calendars: from n/a through 20231125...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS.This issue affects WP Remote Site Search: from n/a through 1.0.4...

PT-2023-31700

Name of the Vulnerable Software and Affected Versions Automattic WordPress.Com Editing Toolkit versions from n/a through 3.78784 Description The issue affects the Automattic WordPress.Com Editing Toolkit, allowing Stored XSS due to improper neutralization of input during web page generation. This...

CVE-2023-50822

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Currency.Wiki Currency Converter Widget – Exchange Rates allows Stored XSS.This issue affects Currency Converter Widget – Exchange Rates: from n/a through 3.0.2...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Terrier Tenacity iframe Shortcode allows Stored XSS.This issue affects iframe Shortcode: from n/a through 2.0...

PT-2023-31660 · Unknown · Aerin Loan Repayment Calculator/Application Form

Name of the Vulnerable Software and Affected Versions: Aerin Loan Repayment Calculator and Application Form versions n/a through 2.9.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means tha...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nima Saberi Aparat allows Stored XSS.This issue affects Aparat: from n/a through 1.7.1...

CVE-2023-49745

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5...

PT-2023-31539

Name of the Vulnerable Software and Affected Versions Livemesh WPBakery Page Builder Addons versions through 3.5 Description The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations...

PT-2023-31384

Name of the Vulnerable Software and Affected Versions Spectra – WordPress Gutenberg Blocks versions 2.7.9 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can...

CVE-2023-48715: Improper Neutralization of Input During Web Page Generation

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Community Edition and prior to versions 15.2-4 and 15.1-8 of Tuleap Enterprise Edition, the name of the releases are not properly escaped on the edition page of ...

PT-2023-30654 · Unknown · Perfmatters

Name of the Vulnerable Software and Affected Versions: Perfmatters versions prior to 2.2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject maliciou...

CVE-2023-6426: Improper Neutralization of Input During Web Page Generation

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoicesview.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user...

PT-2023-27816

Name of the Vulnerable Software and Affected Versions Laurence/OhMyBox.Info Simple Long Form versions n/a through 2.2.2 Description The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can...

PT-2023-30597

Name of the Vulnerable Software and Affected Versions Russell Jamieson Footer Putter plugin versions 1.17 and earlier Description The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations For Russell Jamieson Foote...

PT-2023-30618

Name of the Vulnerable Software and Affected Versions Christina Uechi Add Widgets to Page plugin versions = 1.3.2 Description The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations For Christina Uechi Add Widget...

CVE-2023-1716 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)

Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...

CVE-2023-43509: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading...