CVE-2021-34654 Custom Post Type Relations <= 1.0 Reflected Cross-Site Scripting

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-34654 Custom Post Type Relations <= 1.0 Reflected Cross-Site Scripting

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-34653 WP Fountain <= 1.5.9 Reflected Cross-Site Scripting

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...

CVE-2021-34653 WP Fountain <= 1.5.9 Reflected Cross-Site Scripting

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...

CVE-2021-34653

The CVE-2021-34653 entry pertains to the WordPress plugin WP Fountain, with vulnerability in versions up to and including 1.5.9. It is a Reflected Cross-Site Scripting (XSS) flaw caused by using $_SERVER['PHP_SELF'] in wp-fountain.php, enabling injection of arbitrary scripts. The connected source...

CVE-2021-34649

The CVE-2021-34649 affects the WordPress plugin Simple Behance Portfolio (versions

CVE-2021-34649 Simple Behance Portfolio <= 0.2 Reflected Cross-Site Scripting

The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dark parameter in the /titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2...

CVE-2021-34652 Media Usage <= 0.0.4 Reflected Cross-Site Scripting

The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the /mmuadmin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.4...

CVE-2021-34642

The CVE-2021-34642 entry concerns the WordPress Smart Email Alerts plugin (versions up to 1.0.10) vulnerable to Reflected Cross-Site Scripting via the api_key in ~/views/settings.php. The underlying issue allows injection of arbitrary scripts, with network access and user interaction required (CV...

CVE-2021-34642 Smart Email Alerts <= 1.0.10 Reflected Cross-Site Scripting

The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10...

CVE-2021-34642 Smart Email Alerts <= 1.0.10 Reflected Cross-Site Scripting

The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10...

CVE-2021-34644 Multiplayer Games <= 3.7 Reflected Cross-Site Scripting

The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /multiplayergames.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.7...

CVE-2021-34644

The CVE-2021-34644 entry relates to the WordPress plugin Multiplayer Games, affected up to version 3.7. The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw caused by the use of $_SERVER['PHP_SELF'] in the multiplayergames.php file, enabling attackers to inject arbitrary web scripts. ...

CVE-2021-34643

Summary: CVE-2021-34643 affects the WordPress Skaut bazar plugin. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw caused by using $_SERVER['PHP_SELF'] in the file skaut-bazar.php. Affected versions are up to and including 1.3.2. Impact (as described): Attackers can inject arbitra...

SP Project & Document Manager < 4.26 - Reflected Cross-Site Scripting

The plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts PoC https://example.com/wp-admin/admin.php?page=sp-client-document-manager=" style=animation-name:rotation...

WordPress Afterpay Gateway for WooCommerce plugin <= 3.2.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Afterpay Gateway for WooCommerce plugin versions = 3.2.0. Solution Update the WordPress Afterpay Gateway for WooCommerce plugin to the latest available version at least 3.2.1...

CBX Bookmark & Favorite < 1.6.9 - Reflected Cross-Site Scripting

The plugin does not escape a page parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues PoC...

Email Artillery <= 4.1 - Multiple Reflected Cross-Site Scripting

The plugin does not sanitise, validate or escape some user input before outputting back in pages leading to Reflected Cross-Site Scripting issues which will be executed in the context of a logged in admin PoC https://example.com/wp-admin/admin.php?page=etmbu-all-posts=yes=no="="...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugins is an open source application plugin for WordPress. WordPress Plugins 2TypoFR A security...

WordPress Add Sidebar plugin <= 2.0.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Add Sidebar plugin versions = 2.0.0. Solution This plugin has been closed as of August 12, 2021 and is not available for download. This closure is temporary, pending a full review...