CVE-2022-2627

CVE-2022-2627 affects the WordPress Newspaper theme prior to 12. The issue is a cross-site scripting flaw where a parameter is not sanitized before being output back in an HTML attribute via an AJAX action, enabling a reflected XSS. The Nuclei template notes that exploitation could allow an attac...

CVE-2022-2627 Newspaper < 12 - Reflected Cross-Site Scripting

The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting...

CVE-2022-2167 Newspaper < 12 - Reflected Cross-Site Scripting

The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting...

CVE-2022-2190 Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting

The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2022-2190

CVE-2022-2190 affects the WordPress Gallery Plugin (Envira Gallery Lite) versions prior to 1.8.4.7. The underlying issue is that the plugin does not escape the $_SERVER['REQUEST_URI'] value before outputting it into an HTML attribute, enabling Reflected Cross-Site Scripting in older browsers. Acc...

CVE-2022-2627 Newspaper < 12 - Reflected Cross-Site Scripting

The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting...

CVE-2022-3440 Rock Convert < 2.6.0 - Reflected Cross-Site Scripting

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting...

CVE-2022-3440 Rock Convert < 2.6.0 - Reflected Cross-Site Scripting

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting...

PT-2022-15182 · WordPress · Gallery Plugin

Name of the Vulnerable Software and Affected Versions: The Gallery Plugin for WordPress versions prior to 1.8.4.7 Description: The issue concerns the failure to escape the REQUEST URI parameter before outputting it back in an attribute. This could lead to Reflected Cross-Site Scripting in old web...

CVE-2021-36864

Auth. editor+ Reflected Cross-Site Scripting XSS vulnerability in ExpressTech Quiz And Survey Master plugin = 7.3.4 on WordPress...

CVE-2021-36864 WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability

Auth. editor+ Reflected Cross-Site Scripting XSS vulnerability in ExpressTech Quiz And Survey Master plugin = 7.3.4 on WordPress...

CVE-2022-40183 Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting XSS in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user...

CVE-2022-40183 Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting XSS in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user...

CVE-2022-36783

AlgoSec – FireFlow Reflected Cross-Site-Scripting RXSS A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user victim. JavaScript code is executed on...

CVE-2022-36783

AlgoSec – FireFlow Reflected Cross-Site-Scripting RXSS A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user victim. JavaScript code is executed on...

CVE-2022-38195 BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server

There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

CVE-2022-36783 AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)

AlgoSec – FireFlow Reflected Cross-Site-Scripting RXSS A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user victim. JavaScript code is executed on...

CVE-2022-36783

CVE-2022-36783 affects AlgoSec FireFlow with a Reflected Cross-Site-Scripting (RXSS) vector. A malicious user can inject JavaScript into the IntersectudRule parameter on the search/result.html page by changing the request method from POST to GET and sharing the URL with a victim. This results in ...

PT-2022-24249 · F Secure · F-Secure Policy Manager

Name of the Vulnerable Software and Affected Versions: WithSecure versions prior to 2022-08-10 Description: The issue is related to reflected cross-site scripting XSS vulnerabilities due to an unvalidated parameter in an endpoint, allowing remote attackers to provide malicious input. This affects...

Grid Kit Premium <= 1.8.53 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in various pages, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=grid-kit&action=edit&id=...