9612 matches found
CVE-2023-4635
The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...
CVE-2023-3965
The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
Cross site scripting
The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
Cross site scripting
The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2023-3933 Your Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting
The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2023-3933
The CVE-2023-3933 entry applies to the WordPress Your Journey theme (versions up to and including 1.9.8). Reported vulnerability: Reflected Cross-Site Scripting via prototype pollution caused by insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject arbi...
CVE-2023-3933 Your Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting
The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2023-3965
CVE-2023-3965 refers to the WordPress theme nsc (versions <= 1.0). The vulnerability is described as a Reflected Cross-Site Scripting via prototype pollution caused by insufficient input sanitization and output escaping. Unauthenticated attackers could inject arbitrary scripts into pages that ...
CVE-2023-3965 nsc <= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting
The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
Product Category Tree <= 2.5 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-45065
CVE-2023-45065 concerns the WordPress plugin Bulk NoIndex & NoFollow Toolkit by Mad Fish (vendor: Mad Fish; plugin: Bulk NoIndex & NoFollow Toolkit). Affected versions are
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Thomas Scholl canvasio3D Light plugin = 2.4.6 versions...
CVE-2023-25476
CVE-2023-25476 affects the WordPress plugin AmpedSense – AdSense Split Tester (versions
CVE-2023-45004
Unauth. Reflected Cross-Site Scripting XSS vulnerability in wp3sixty Woo Custom Emails plugin = 2.2 versions...
CVE-2023-45003
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin = 2.2.0 versions...
GHSA-W2G3-J73Q-7QV7 Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page
Reflected cross-site scripting XSS vulnerability on the Export for Translation page before 2.0.86 from Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the...
CVE-2023-42497
Reflected cross-site scripting XSS vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the...
CVE-2023-4290 WP Matterport Shortcode < 2.1.7 - Reflected XSS
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHPSELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin...
Awesome Support < 6.1.5 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC Visit the following URL as an admin user, with any valid ticket ID. Press the acce...
Simple Membership Plugin For WordPress < 4.1.1 Reflected Cross-Site Scripting
The WordPress Simple Member Plugin installed on the remote host is affected by a reflected Cross-Site scripting vulnerability due to improper sanitisation of parameters before outputting them as AJAX actions. Note that the scanner has not tested for these issues but has instead relied only on the...