CVE-2024-52875

Kerio Control (GFI) versions 9.2.5–9.4.5 are affected by a CRLF/HTTP response splitting vulnerability that abuses the dest parameter in GET requests to generate a Location header in a 302 response, enabling Open Redirect and HTTP Response Splitting, which can lead to reflected XSS. The issue affe...

PT-2025-1999 · WordPress · Opsi Israel Domestic Shipments

Name of the Vulnerable Software and Affected Versions: OPSI Israel Domestic Shipments WordPress plugin versions 2.6.3 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputt...

PT-2025-2080

Name of the Vulnerable Software and Affected Versions A5 Custom Login Page WordPress plugin versions 2.8.1 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in t...

PT-2025-2073

Name of the Vulnerable Software and Affected Versions Privacy Policy Genius WordPress plugin versions through 2.0.4 Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2025-2077 · WordPress · Tabulate

Name of the Vulnerable Software and Affected Versions: Tabulate WordPress plugin versions 2.10.3 and earlier Description: The issue arises from the plugin not sanitizing and escaping some parameters before outputting them back in the page. This leads to a Reflected Cross-Site Scripting that could...

DevDojo Voyager vulnerable to reflected Cross-site Scripting

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed...

GHSA-MM49-4F2G-C3WF DevDojo Voyager vulnerable to reflected Cross-site Scripting

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed...

CVE-2024-13705

The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 9.8.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVE-2024-12320

The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2024-12299

The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-12299 System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter

The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-12299

CVE-2024-12299 (WordPress System Dashboard plugin) : Affected plugin versions

CVE-2024-12177 Ai Image Alt Text Generator for WP <= 1.0.6 - Reflected Cross-Site Scripting

The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2024-12177 Ai Image Alt Text Generator for WP <= 1.0.2 - Reflected Cross-Site Scripting

The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2024-12177

The CVE-2024-12177 entry concerns the WordPress plugin Ai Image Alt Text Generator for WP. It is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to 1.0.2 due to insufficient input sanitization and output escaping. This enables unauthenticated attackers to in...

CVE-2024-12320 Team Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'

The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2024-12320

CVE-2024-12320 refers to a Reflected Cross-Site Scripting vulnerability in the WordPress plugin Team Rosters (versions up to 4.7). The issue arises from insufficient input sanitization and output escaping in the tab parameter, enabling unauthenticated attackers to inject web scripts into pages th...

CVE-2024-12320 Team Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'

The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2024-13705

The CVE-2024-13705 entry concerns the WordPress StageShow plugin. Affected versions are all 9.8.6 and earlier, with the root cause being insufficient escaping of the URL when using remove_query_arg, enabling reflected XSS. Public details from connected sources indicate the issue persists up to 9....

CVE-2024-13705 StageShow <= 9.8.6 - Reflected Cross-Site Scripting

The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 9.8.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...