Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting

The plugin does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=advanceddbcleaner&aDBctab=cron&aDBccat=all&"alert/XSS/ Other pages are affected...

Download Manager < 3.2.44 - Unauthenticated Reflected Cross-Site Scripting

The plugin does not escape a generated URL before outputting it back in an attribute of the login page made by the plugin, leading to Reflected Cross-Site Scripting, which is only exploitable against unauthenticated users On the login page from the plugin ie where the wpdmloginform is embed, appe...

CVE-2022-29931

CVE-2022-29931 affects Raytion Custom Security Manager (CSM) administration interface in version 7.2.0, where a reflected Cross-site Scripting (XSS) vulnerability exists. The vulnerability arises in the admin UI and could allow injection of malicious scripts into the browser for victims visiting ...

CVE-2022-29931

The administration interface of the Raytion Custom Security Manager Raytion CSM in Version 7.2.0 allows reflected Cross-site Scripting XSS...

PT-2022-19915 · Raytion · Raytion Custom Security Manager

Name of the Vulnerable Software and Affected Versions: Raytion Custom Security Manager version 7.2.0 Description: The administration interface of the Raytion Custom Security Manager allows reflected Cross-site Scripting XSS. This issue can be exploited through the administration interface,...

GHSA-39R3-H8Q6-2PHQ Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin

Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting XSS vulnerability. Embeddable Build Status Plugin 2.0.4 limits URLs to http and https...

CVE-2022-31786

IdeaLMS 2022 allows reflected Cross Site Scripting XSS via the IdeaLMS/Class/Assessment/ PATHINFO...

Import CSV Files <= 1.0 - Reflected Cross-Site Scripting

The plugin does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting PoC...

WordPress CDI plugin <= 5.1.8 - Reflected Cross-Site-Scripting (XSS) vulnerability

Reflected Cross-Site-Scripting XSS vulnerability discovered by WordPress CDI plugin versions = 5.1.8. Solution Update the WordPress CDI plugin to the latest available version at least 5.1.9...

CDI < 5.1.9 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting...

CVE-2021-25104

The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-25104

The CVE-2021-25104 issue affects the WordPress Ocean Extra plugin (versions before 1.9.5). The root cause is that generated links are not escaped when the OceanWP theme is active, leading to a Reflected Cross-Site Scripting vulnerability. The vulnerability is addressed in version 1.9.5 (remediati...

CVE-2021-25104 Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting

The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-31734

Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior to 12.250SY...

CVE-2017-20061 Elefant CMS extended Reflected cross site scriting

A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20src=no%20onerror=alert1%3E leads to basic cross site scripting Reflected. The...

Give < 2.21.0 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/edit.php?posttype=giveforms&page=give-tools&a"alert/XSS/...

Give < 2.21.0 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/edit.php?posttype=giveforms=give-tools" https://example.com/wp-admin/edit.php?posttype=giveforms=give-tools=import" Other pages are also affec...

WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 2.15.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by ZhongFu Su aka JrXnm WuHan University in WordPress WooCommerce PDF Invoices & Packing Slips plugin versions = 2.15.0. Solution Update the WordPress WooCommerce PDF Invoices & Packing Slips plugin to the latest available version at lea...

Haraj 跨站脚本漏洞

Haraj is a buying and selling platform from Haraj Saudi Arabia. A security vulnerability exists in Haraj version 3.7, which stems from a reflected cross-site scripting issue in the User Upgrade Form...

WooCommerce - Product Importer <= 1.5.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting POST /wp-admin/admin.php?page=woopi&tab=import HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8...