9612 matches found
CVE-2024-8665 YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting
The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
CVE-2024-8665 YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting
The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
CVE-2024-8656
The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...
CVE-2024-8656
The WPFactory Helper plugin for WordPress is affected by CVE-2024-8656: Reflected Cross‑Site Scripting in all versions up to and including 1.7.0 due to insufficient escaping in add_query_arg. This allows unauthenticated attackers to inject scripts in pages triggered by user actions. Patch: update...
PT-2024-39214 · WordPress · Pdf Thumbnail Generator
Name of the Vulnerable Software and Affected Versions: PDF Thumbnail Generator plugin for WordPress versions up to, and including, 1.3 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...
PT-2024-39261 · WordPress · Wp Booking System – Booking Calendar
Name of the Vulnerable Software and Affected Versions: The WP Booking System – Booking Calendar plugin for WordPress versions up to, and including, 2.0.19.8 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without appropriate...
CVE-2024-8622
The amCharts: Charts and Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'amchartsjavascript' parameter in all versions up to, and including, 1.4.4 due to the ability to supply arbitrary JavaScript a lack of nonce validation on the preview functionality. This mak...
CVE-2024-8622
The CVE-2024-8622 entry concerns the amCharts: Charts and Maps plugin for WordPress. Affected versions are
WordPress Spiffy Calendar plugin <= 4.9.13 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Spiffy Calendar versions = 4.9.13...
CVE-2024-8056
The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2024-6018
The Music Request Manager WordPress plugin through 1.3 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2024-8056
CVE-2024-8056 affects MM-Breaking News WordPress plugin (versions ≤ 0.7.9). Root cause: failure to escape $_SERVER['REQUEST_URI'] when emitting it inside an HTML attribute, enabling Reflected Cross-Site Scripting in older browsers. Public sources (including Red Hat advisory and Patchstack) corrob...
CVE-2024-6018
CVE-2024-6018 affects Music Request Manager WordPress plugin
CVE-2024-6018 Music Request Manager <= 1.3 - Reflected XSS
The Music Request Manager WordPress plugin through 1.3 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
PT-2024-39155 · WordPress · Wpfactory Helper
Name of the Vulnerable Software and Affected Versions: WPFactory Helper plugin for WordPress versions up to, and including, 1.7.0 Description: The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on...
CVE-2024-45176
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cross-site scripting XSS attacks. It was found out that different functions are prone to reflected cross-site scripting attacks due to...
CVE-2024-7077
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Reflected XSS.This issue affects Semtek Sempos: through 31072024...
CVE-2024-8119
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...
CVE-2024-8117
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selectedoption’ parameter in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...