Cross site scripting

The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the /processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0...

Cross site scripting

The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the /htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1...

Cross site scripting

The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the /llm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

Cross site scripting

The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the /includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-39313 Simple Image Gallery <= 1.0.6 Reflected Cross-Site Scripting

The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the /simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6...

CVE-2021-39313

CVE-2021-39313 affects the WordPress Simple Image Gallery plugin. The vulnerability is a Reflected Cross-Site Scripting flaw in the simple-image-gallery.php file, exploitable via the msg parameter and permits injection of arbitrary client-side scripts. The issue is present in versions up to and i...

CVE-2021-39310 Real WYSIWYG <= 0.0.2 Reflected Cross-Site Scripting

The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHPSELF in the /real-wysiwyg.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2...

CVE-2021-39310 Real WYSIWYG <= 0.0.2 Reflected Cross-Site Scripting

The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHPSELF in the /real-wysiwyg.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2...

CVE-2021-39308 WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting

The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the /processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0...

CVE-2021-39308

Vulnerability summary (CVE-2021-39308) : The WordPress plugin “WooCommerce myghpay Payment Gateway” is vulnerable to Reflected Cross-Site Scripting via the clientref parameter in ~/processresponse.php, affecting versions up to 3.0. The issue can allow injection of arbitrary JavaScript in the clie...

CVE-2021-38361

The CVE-2021-38361 entry concerns the WordPress .htaccess Redirect plugin (versions

CVE-2021-38361 .htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting

The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the /htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1...

CVE-2021-39311 link-list-manager <= 1.0 Reflected Cross-Site Scripting

The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the /llm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-39309

CVE-2021-39309 affects the WordPress plugin “Parsian Bank Gateway for Woocommerce.” The issue is a Reflected Cross-Site Scripting (XSS) vulnerability arising from a var_dump() on $_POST variables in the file ~/vendor/dpsoft/parsian-payment/sample/rollback-payment.php, allowing injection of arbitr...

CVE-2021-39311

The CVE-2021-39311 affects the WordPress plugin Link List Manager (versions up to 1.0). The vulnerability is a Reflected Cross-Site Scripting via the category parameter in the llm.php script, caused by lack of input validation/filtering. Impact as per sources: attacker could inject client-side sc...

CVE-2021-39314

The CVE-2021-39314 entry concerns the WordPress WooCommerce EnvioPack plugin (

CVE-2021-39314 WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting

The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the /includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-39318 H5P CSS Editor <= 1.0 Reflected Cross-Site Scripting

The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the /h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-39318

The CVE concerns the WordPress H5P CSS Editor plugin (versions

CVE-2021-39318 H5P CSS Editor <= 1.0 Reflected Cross-Site Scripting

The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the /h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...