9612 matches found
CVE-2021-38354
The issue is a Reflected Cross-Site Scripting vulnerability in the WordPress plugin GNU-Mailman Integration (versions up to and including 1.0.6). The flaw is triggered via the gm_error parameter in the file path ~/includes/admin/mailing-lists-page.php , allowing an attacker to inject arbitrary we...
CVE-2021-38354 GNU-Mailman Integration <= 1.0.6 Reflected Cross-Site Scripting
The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gmerror parameter found in the /includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6...
CVE-2021-38327 YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting
The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0...
CVE-2021-38327 YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting
The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0...
CVE-2021-38339 Simple Matted Thumbnails <= 1.01 Reflected Cross-Site Scripting
The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.01...
CVE-2021-38339
The CVE-2021-38339 entry affects the WordPress plugin Simple Matted Thumbnails, version ≤ 1.01. The vulnerability is a Reflected Cross-Site Scripting flaw caused by a reflected value in $_SERVER["PHP_SELF"] within the simple-matted-thumbnail.php file, enabling an attacker to inject arbitrary web ...
CVE-2021-38347 Custom Website Data <= 2.2 Reflected Cross-Site Scripting
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the /views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2...
CVE-2021-38347
CVE-2021-38347 concerns the WordPress plugin Custom Website Data (<= 2.2). The vulnerability is a Reflected Cross-Site Scripting (XSS) via the id parameter in the file ~/views/edit.php, enabling an attacker to inject arbitrary web scripts. Affected release range is up to and including 2.2. NVD...
CVE-2021-38347 Custom Website Data <= 2.2 Reflected Cross-Site Scripting
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the /views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2...
CVE-2021-38355 Bug Library <= 2.0.3 Reflected Cross-Site Scripting
The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the /bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3...
CVE-2021-38355 Bug Library <= 2.0.3 Reflected Cross-Site Scripting
The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the /bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3...
CVE-2021-38355
CVE-2021-38355 affects the WordPress Bug Library plugin up to version 2.0.3. The vulnerability is a reflected Cross-Site Scripting via the successimportcount parameter in ~/bug-library.php, enabling attackers to inject arbitrary web scripts. Exploitation details are not provided in the supplied d...
CVE-2021-38336 Edit Comments XT <= 1.0 Reflected Cross-Site Scripting
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...
CVE-2021-38336 Edit Comments XT <= 1.0 Reflected Cross-Site Scripting
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...
CVE-2021-38336
CVE-2021-38336 affects the WordPress plugin Edit Comments XT (versions up to and including 1.0). The root cause is a reflected Cross-Site Scripting (XSS) vulnerability caused by a reflected $_SERVER["PHP_SELF"] value in the file ~/edit-comments-xt.php, enabling attackers to inject arbitrary web s...
CVE-2021-38335 Wise Agent Capture Forms <= 1.0 Reflected Cross-Site Scripting
The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...
CVE-2021-38335
The CVE-2021-38335 entry relates to the WordPress plugin Wise Agent Capture Forms (
CVE-2021-38329
The CVE-2021-38329 entry concerns the WordPress plugin DJ EmailPublish. Affected product: DJ EmailPublish WordPress plugin (versions up to and including 1.7.2). Root cause: reflected XSS caused by a reflected $_SERVER["PHP_SELF"] in~/dj-email-publish.php. Impact: attackers can inject arbitrary we...
CVE-2021-38329 DJ EmailPublish <= 1.7.2 Reflected Cross-Site Scripting
The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2...
CVE-2021-38329 DJ EmailPublish <= 1.7.2 Reflected Cross-Site Scripting
The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2...