9612 matches found
CVE-2022-23912
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
CVE-2022-0189
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprssfetchitemsrowaction AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting...
CVE-2021-25034
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the wpuser shortcode is used, leading to Reflected Cross-Site Scripting issues...
CVE-2021-25112
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting...
CVE-2022-0189
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprssfetchitemsrowaction AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting...
CVE-2022-0189
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprssfetchitemsrowaction AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting...
CVE-2020-36510
The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cbsa AJAX action, leading to a Reflected Cross-Site Scripting...
CVE-2022-23912 AP Custom Testimonial < 1.4.8 - Reflected Cross-Site Scripting
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
CVE-2022-0189
CVE-2022-0189 affects the WordPress WP RSS Aggregator plugin up to version 4.20. The issue is a reflected XSS in the wprss_fetch_items_row_action AJAX endpoint caused by insufficient sanitization/escaping of the id parameter in the response. The exploitation requires an authenticated user (per th...
CVE-2022-0150 WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)
The WP Accessibility Helper WAH WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue...
CVE-2022-0150
The WordPress WP Accessibility Helper (WAH) plugin, versions prior to 0.6.0.7, contains a Reflected Cross-Site Scripting (XSS) vulnerability triggered by the wahi parameter. The issue arises because the plugin does not sanitize/escape the base64-decoded wahi output before rendering it on the page...
CVE-2021-25034 WP User < 7.0 - Reflected Cross-Site Scripting
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the wpuser shortcode is used, leading to Reflected Cross-Site Scripting issues...
CVE-2021-25034
CVE-2021-25034 affects the WordPress WP User plugin before 7.0. The root cause is lack of sanitisation/escaping of certain parameters in pages using the [wp_user] shortcode, enabling Reflected Cross-Site Scripting (XSS). Public sources (NVD/NVD-derived entries and vendor references) describe a re...
CVE-2021-24933 Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting
The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the termtree AJAX action available to any authenticated users, leading to a Reflected Cross-Site Scripting issue...
CVE-2020-36510 15Zine < 3.3.0 - Reflected Cross-Site Scripting
The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cbsa AJAX action, leading to a Reflected Cross-Site Scripting...
CVE-2020-36510
CVE-2020-36510 – WordPress 15Zine < 3.3.0 The 15Zine WordPress theme prior to version 3.3.0 fails to sanitize/escape the cbi parameter when echoing it back in the HTTP response via the cb_s_a AJAX action, causing a reflected Cross-Site Scripting (XSS) vulnerability. Affected product: WordPress...
AP Mega Menu < 3.0.8 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=wpmm-add-theme&wpnonce="...
CVE-2022-24338
JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS...
CVE-2022-24338
JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS...
Contact Form X < 2.4.1 - Reflected Cross-Site Scripting
The plugin does not escape the tab parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/options-general.php?page=contactformx="+style=animation-name:rotation+onanimationstart=alert/XSS///...