CVE-2023-36346

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the nmmember parameter at print.php...

EUVD-2023-40314

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the nmmember parameter at print.php...

GHSA-X234-MG7Q-M8G8 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alertdocument.domain This vulnerability exists sin...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Robin Wilson bbp style pack plugin = 5.5.5 versions...

CVE-2023-28784

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Contest Gallery plugin = 21.1.2 versions...

CVE-2023-30500 WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPForms WPForms Lite wpforms-lite, WPForms WPForms Pro wpforms plugins = 1.8.1.2 versions...

CVE-2023-28776 WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin = 1.0.15 versions...

CVE-2023-28776

CVE-2023-28776: Unauthenticated reflected XSS in WordPress plugin Continuous Image Carousel With Lightbox (

CVE-2023-33387

A reflected cross-site scripting XSS vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link...

CVE-2023-33387

A reflected cross-site scripting XSS vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link...

CVE-2023-27432 WordPress Manage Upload Limit Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WpSimpleTools Manage Upload Limit plugin = 1.0.4 versions...

WooCommerce Product Vendors < 2.1.77 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page with the code below html...

PT-2023-21121 · WordPress · Wpsimpletools Manage Upload Limit

Name of the Vulnerable Software and Affected Versions: WpSimpleTools Manage Upload Limit plugin versions 1.0.4 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for reflected cross-site scripting attacks without...

CVE-2023-35097

CVE-2023-35097 affects WP Affiliate Links (Internet Marketing Dojo) plugin for WordPress, specifically versions ≤ 0.1.1. The vulnerability is unauthenticated reflected XSS in the plugin, enabling injection of malicious scripts via user-supplied input. Exploitation status is not detailed in the pr...

CVE-2023-35098 WordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in John Brien WordPress NextGen GalleryView plugin = 0.5.5 versions...

CVE-2023-35884

Unauth. Reflected Cross-Site Scripting XSS vulnerability in EventPrime plugin = 3.0.5 versions...

CVE-2023-35775

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WP Backup Solutions WP Backup Manager plugin = 1.13.1 versions...

CVE-2023-2654 Conditional Menus < 1.2.1 - Reflected XSS

The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2654 Conditional Menus < 1.2.1 - Reflected XSS

The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2779 Super Socializer < 7.13.52 - Reflected XSS

The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...