9612 matches found
CVE-2023-5354 Awesome Support < 6.1.5 - Reflected Cross-Site Scripting
The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-46732 Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a...
CVE-2023-46732
XWiki Platform is vulnerable to reflected cross-site scripting (RXSS) via the rev parameter used in the content menu. An attacker enticing a user to visit a crafted link could execute actions as that user, including Groovy remote code execution for users with programming rights, potentially compr...
CVE-2023-46822
CVE-2023-46822 affects the WordPress Store Exporter for WooCommerce plugin (Visser Labs Store Exporter for WooCommerce) version ≤ 2.7.2. The issue is an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability in the plugin, with root cause identified as improper input handling/exposur...
PT-2023-8601 · Xwiki · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.14 XWiki Platform versions prior to 15.5.1 XWiki Platform versions prior to 15.6 RC1 Description: The issue is related to reflected cross-site scripting RXSS via the rev parameter used in the content of...
CVE-2023-5946
The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'currentgroupid' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
Cross site scripting
The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'currentgroupid' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
CVE-2023-5946
The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'currentgroupid' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
Your Journey theme <= 1.9.8 - Reflected Cross-Site Scripting via Prototype Pollution
Description The plugin does not properly sanitize input and escape output, resulting in a vulnerability to Reflected Cross-Site Scripting via prototype pollution. This could lead to the injection of arbitrary web scripts in pages that execute when a user is tricked into performing an action like...
Grid Plus <= 1.3.4 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-46448
Reflected Cross-Site Scripting XSS vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images...
CVE-2023-46448
Reflected Cross-Site Scripting XSS vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images...
CVE-2023-46448
Reflected Cross-Site Scripting XSS vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images...
PT-2023-30027 · Unknown · Dmpop Mejiro
Name of the Vulnerable Software and Affected Versions: dmpop Mejiro versions prior to 3096393 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability that allows attackers to run arbitrary code via a crafted string in the metadata of uploaded images. This can be exploited by...
CVE-2023-5211
The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability...
CVE-2023-4250
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-4250 EventPrime < 3.2.0 - Reflected XSS
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-5211 Fattura24 < 6.2.8 - Reflected Cross-Site Scripting
The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability...
CVE-2023-47096
CVE-2023-47096 is a reflected XSS vulnerability in Virtualmin 7.7, affecting the Cloudmin Services Client under System Setting. The issue is triggered via the Cloudmin services master field, allowing an attacker to inject arbitrary web script/html. Several connected records corroborate the vulner...