Cross site scripting

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin ...

CVE-2022-1528

The CVE-2022-1528 entry affects the VikBooking Hotel Booking Engine & PMS WordPress plugin (before 1.5.9). The vulnerability is a Reflected Cross-Site Scripting caused by not escaping the current URL before embedding it in a JavaScript context, enabling potential script execution. Reported PoCs s...

CVE-2022-1528 VikBooking < 1.5.9 - Reflected Cross-Site Scripting

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...

CVE-2022-1009

The CVE-2022-1009 entry concerns the WordPress Smush plugin (versions before 3.9.9). The vulnerability is a Reflected Cross-Site Scripting caused by the plugin not sanitising/escaping a configuration parameter before outputting it in an admin page when uploading a malicious preset configuration. ...

New User Approve < 2.4.1 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting With the Membership settings /wp-admin/options-general.php disabled: https://example.com/wp-admin/index.php?a"alert/XSS/...

New User Approve < 2.4.1 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC With the Membership settings /wp-admin/options-general.php disabled: https://example.com/wp-admin/index.php?a"...

CVE-2021-32989

When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...

CVE-2021-32989

When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...

GHSA-JWXH-WJ79-CCM6 Magento Reflected Cross-site Scripting vulnerability via 'file' parameter

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required...

Moodle Vulnerable to Reflected Cross-site Scripting

It was found in Moodle before version 4.0.0-beta that some search inputs were vulnerable to reflected Cross-site Scripting XSS due to insufficient escaping of search queries...

GHSA-XHFX-RM8Q-C3XV Moodle Vulnerable to Reflected Cross-site Scripting

It was found in Moodle before version 4.0.0-beta that some search inputs were vulnerable to reflected Cross-site Scripting XSS due to insufficient escaping of search queries...

GHSA-MVQR-R76C-WM5F Devise Token Auth vulnerable to Cross-site Scripting

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

GHSA-R728-JWF5-F5R5 Magento Reflected cross-site scripting on customer cart page

A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's...

Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting

The plugin does not escape generated links which are then used when the OceanWP theme is active, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/?step=demo=owpsetup"...

Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting

The plugin does not escape generated links which are then used when the OceanWP theme is active, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/?step=demo&page=owpsetup&a"alert/XSS/...

CVE-2022-1547

The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1547

The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1221

The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting...

CVE-2022-1218

The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...