CVE-2021-38356

The CVE affects the WordPress plugin NextScripts: Social Networks Auto-Poster (versions

CVE-2021-24808

The CVE-2021-24808 entry describes a Reflective Cross-Site Scripting in the BP Better Messages WordPress plugin prior to version 1.9.9.41. Root cause: the plugin sanitises the subject via sanitize_text_field but fails to escape it when outputting back into an HTML attribute, enabling attack strin...

PT-2021-16824 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue allows a remote attacker to steal administrators' session cookies or perform actions as an administrator due to multiple reflected Cross Script Scripting vulnerabilities via the...

My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting

The plugin does not sanitise and escape the callback parameter of the mcpostlookup AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue PoC...

Check & Log Email < 1.0.4 - Reflected Cross-Site Scripting

The plugin does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting PoC With the "Enable Logs" setting activated: https://example.com/wp-admin/admin.php?page=check-email-logs="+style=animation-name:rotation+onanimationstart=alert/XSS//...

Ibtana - Ecommerce Product Addons < 0.2.4 - Reflected Cross-Site Scripting

The plugin does not escape some user input before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues. PoC v v 0.2.4 - https://example.com/wp-admin/admin.php?page=ibtana-custom-post-typeid="+style=animation-name:rotation+onanimationstart=alert/XSS///...

Ibtana - Ecommerce Product Addons < 0.2.4 - Reflected Cross-Site Scripting

The plugin does not escape some user input before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues. v alert/XSS/ v 0.2.4 - https://example.com/wp-admin/admin.php?page=ibtana-custom-post-type&posttypeid="+style=animation-name:rotation+onanimationstart=alert/XSS/...

NextScripts: Social Networks Auto-Poster < 4.3.21 - Reflected Cross-Site Scripting

The plugin does not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-24885

The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-24885 YOP Poll < 6.1.2 - Reflected Cross-Site Scripting

The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-24885

The CVE-2021-24885 entry describes a vulnerability in the YOP Poll WordPress plugin (versions prior to 6.1.2). The issue arises because the perpage parameter is not escaped before being output in an attribute, causing Reflected Cross-Site Scripting. Affected software: YOP Poll WordPress plugin

WP Spell Check < 9.3 - Reflected Cross-Site Scripting

The plugin does not escape the page and wpsc-scan-tab parameters before outputting them back in attributes, leading Reflected Cross-Site Scripting issues PoC...

Ecommerce - Two Factor Authentication < 1.0.5 - Reflected Cross-Site Scripting

The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue v alert/XSS/ v 1.0.5: https://example.com/wp-admin/users.php?page=reset&action=resetedit&user="...

Mail.ru: reflected xss in e.mail.ru

Login and go to https://e.mail.ru/addressbook/letter/S?afterReload=1&MailboxStatusAutoCall=alert1 Impact Stealing users' information...

CVE-2021-31682

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

CVE-2021-27746

"HCL Connections Security Update for Reflected Cross-Site Scripting XSS Vulnerability"...

CVE-2021-27746

HCL Connections has a reflected XSS vulnerability (CVE-2021-27746) due to insufficient validation of client-side data in the web application. The issue enables attacker-controlled script execution in the user's browser, with CVSSv3.1 base score 5.4 (MEDIUM) and CVSSv2 base score 3.5 (LOW) in repo...

CVE-2021-36869 WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability in WordPress Ivory Search plugin versions = 4.6.6. Vulnerable parameter: &post...

CVE-2021-39354

The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $startdate and $enddate parameters found in the /includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2...

Cross site scripting

The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $startdate and $enddate parameters found in the /includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2...