9596 matches found
CVE-2020-36510
CVE-2020-36510 – WordPress 15Zine < 3.3.0 The 15Zine WordPress theme prior to version 3.3.0 fails to sanitize/escape the cbi parameter when echoing it back in the HTTP response via the cb_s_a AJAX action, causing a reflected Cross-Site Scripting (XSS) vulnerability. Affected product: WordPress...
CVE-2020-36510 15Zine < 3.3.0 - Reflected Cross-Site Scripting
The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cbsa AJAX action, leading to a Reflected Cross-Site Scripting...
AP Mega Menu < 3.0.8 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=wpmm-add-theme&wpnonce="...
CVE-2022-24338
JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS...
CVE-2022-24338
JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS...
Contact Form X < 2.4.1 - Reflected Cross-Site Scripting
The plugin does not escape the tab parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/options-general.php?page=contactformx="+style=animation-name:rotation+onanimationstart=alert/XSS///...
WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ex.Mi Patchstack in WordPress Contact Form X plugin versions = 2.4. Solution Update the WordPress Contact Form X plugin to the latest available version at least 2.4.1...
CVE-2022-0710
The Header Footer Code Manager plugin = 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting XSS via the $REQUEST'page' parameter...
Cross site scripting
The Header Footer Code Manager plugin = 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting XSS via the $REQUEST'page' parameter...
CVE-2022-0710 Header Footer Code Manager <= 1.1.16 Reflected XSS
The Header Footer Code Manager plugin = 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting XSS via the $REQUEST'page' parameter...
CVE-2022-0710 Header Footer Code Manager <= 1.1.16 Reflected XSS
The Header Footer Code Manager plugin = 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting XSS via the $REQUEST'page' parameter...
15Zine < 3.3.0 - Reflected Cross-Site Scripting
Description The theme does not sanitise and escape the cbi parameter before outputing it back in the response via the cbsa AJAX action, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin-ajax.php?action=cbsa=...
15Zine < 3.3.0 - Reflected Cross-Site Scripting
Description The theme does not sanitise and escape the cbi parameter before outputing it back in the response via the cbsa AJAX action, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin-ajax.php?action=cbsa&cbi=alert/XSS/;...
Header Footer Code Manager < 1.1.17 - Reflected Cross-Site Scripting
The plugin does not escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...
CVE-2022-0252
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting...
CVE-2022-0288
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the htmlelementselection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
CVE-2022-0234
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action available to both unauthenticated and authenticated users before outputting it back in the response, leading to a Reflected Cross-Site Scripting...
CVE-2021-25099
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the formid parameter before outputting it back in the response of an unauthenticated request via the givecheckoutlogin AJAX action, leading to a Reflected Cross-Site Scripting...
CVE-2021-25101
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin...