CVE-2021-25099 Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting

The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the formid parameter before outputting it back in the response of an unauthenticated request via the givecheckoutlogin AJAX action, leading to a Reflected Cross-Site Scripting...

CVE-2021-25069

The CVE-2021-25069 entry concerns the WordPress Download Manager plugin, affected in versions before 3.2.34. The root cause is that the plugin does not sanitise/escape the package_ids parameter before using it in an SQL statement, enabling an SQL injection that can also trigger a Reflected Cross-...

CVE-2021-24921 Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting

The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

Countdown & Clock < 2.2.9 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/post-new.php?posttype=ycdcountdown="...

Cookie Information < 2.0.8 - Reflected Cross-Site Scripting

The plugin does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=wp-gdpr-compliance=%27+onanimationstart%3Dalert%28/XSS/%29+style%3Danimation-name%3Arotation+x...

WordPress Countdown & Clock plugin <= 2.2.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Countdown & Clock plugin versions = 2.2.8. Solution Update the WordPress Countdown & Clock plugin to the latest available version at least 2.2.9...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in the Symantec Layer7 API Management OAuth Toolkit OTK allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting...

PT-2022-17205 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate versions through 1.4 Description: An issue was discovered that allows reflected XSS in form descriptions via a user-controlled description. This occurs in the genericForm component. Recommendations: For versions through 1.4, as a...

ARI Fancy Lightbox < 1.3.9 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=ari-fancy-lightbox&msg=%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E...

CVE-2022-24981

A reflected cross-site scripting XSS vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php...

WP Statistic < 13.1.6 - Reflected Cross-Site Scripting

The plugin does not escape various generated links before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=wpsvisitorspage&" https://example.com/wp-admin/admin.php?page=wpsreferrerspage&"...

WP Voting Contest <= 2.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the postid parameter before outputting it back in the response via the wpvcsocialshareicons AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue alert/XSS/' /...

WP Voting Contest <= 2.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the postid parameter before outputting it back in the response via the wpvcsocialshareicons AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue PoC...

Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting PoC Open the following URL when authenticated as any user: https://example.com/user-dashboard/?search=keyword:...

Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting Open the following URL when authenticated as any user: https://example.com/user-dashboard/?search=keyword:...

Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

Exploit Title: Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting XSS Unauthenticated Author: Luis Martinez Discovery Date: 2022-02-13 Vendor Homepage: https://www.uniview.com/Products/NVR/Easy/NVR304-S-P/Product%20features Datasheet of NVR304-S-P:...

CVE-2021-46251

A reflected cross-site scripting XSS in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...

CVE-2021-46251

A reflected cross-site scripting XSS in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...

CVE-2021-46251

ScratchOAuth2 is affected by a reflected XSS vulnerability disclosed as CVE-2021-46251. The issue lies in the POST request handling before commit 1603f04e44ef67dde6ccffe866d2dca16defb293, where insufficient input validation/filtering allows an attacker to inject and execute arbitrary web scripts ...

The Events Calendar < 5.14.0 - Reflected Cross-Site Scripting

The plugin does not escape an aggregator URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting When there is an Event Aggregator license key active: https://example.com/wp-admin/edit.php?page=tribe-common&tab=imports&posttype=tribeevents&"alert/XSS/...