9595 matches found
FV Flowplayer Video Player < 7.5.3.727 - Reflected Cross-Site Scripting
The plugin does not escape or validate the playerid parameter before outputting back in the Stats page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator...
CVE-2021-33703
The CVE-2021-33703 vulnerability affects SAP NetWeaver Enterprise Portal (versions 7.30, 7.31, 7.40, 7.50). Root cause: inadequate encoding of URL parameters in portal servlets, enabling an attacker to craft a malicious link that causes a Reflected XSS when a user visits the link. Impact describe...
Custom Post View Generator <= 0.4.6 - Reflected Cross-Site Scripting
The createpostpage AJAX action of the plugin available to authenticated user does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue PoC...
Two Factor Authentication < 1.0.8 - Reflected Cross-Site Scripting
The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/users.php?page=reset&action=resetedit&user="alert/XSS/...
Custom Post View Generator <= 0.4.6 - Reflected Cross-Site Scripting
The createpostpage AJAX action of the plugin available to authenticated user does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue '...
CVE-2021-37573
A reflected cross-site scripting XSS vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page...
Cross site scripting
The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the /includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18...
CVE-2021-37573
A reflected cross-site scripting XSS vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page...
CVE-2021-34660
WP Fusion Lite WordPress plugin is affected by CVE-2021-34660. The vulnerability is a Reflected Cross-Site Scripting via the startdate parameter in the file ~/includes/admin/logging/class-log-table-list.php, affecting versions up to 3.37.18. The impact is injection of arbitrary web scripts in an ...
CVE-2021-34660 WP Fusion Lite <= 3.37.18 Reflected Cross-Site Scripting
The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the /includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18...
CVE-2021-34660 WP Fusion Lite <= 3.37.18 Reflected Cross-Site Scripting
The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the /includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18...
CVE-2021-24304
The Newsmag WordPress theme before 5.0 does not sanitise the tdblockid parameter in its tdajaxblock AJAX action, leading to an unauthenticated Reflected Cross-site Scripting XSS vulnerability...
Cross site scripting
The Newsmag WordPress theme before 5.0 does not sanitise the tdblockid parameter in its tdajaxblock AJAX action, leading to an unauthenticated Reflected Cross-site Scripting XSS vulnerability...
CVE-2021-24495 Marmoset Viewer < 1.9.3 - Reflected Cross Site Scripting
The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue...
WordPress Woosaleskit Bar plugin <= 1.0.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Woosaleskit Bar plugin versions = 1.0.0. Solution This plugin has been closed as of May 2, 2019 and is not available for download. Reason: Guideline Violation...
WordPress BetterOptin plugin <= 2.0.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress BetterOptin plugin versions = 2.0.2. Solution This plugin has been closed and is no longer available for download...
Form Builder 1.9.8.4 - Reflected Cross-Site Scripting (XSS)
The plugin does not properly sanitise and escape its fromid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue. PoC The formid digits before the payload must be valid: https://example.com/wp-admin/admin.php?page=smuz-formsid=1242;alert/XSS/...
WordPress Station Pro plugin <= 2.2.1 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Station Pro plugin versions = 2.2.1. Solution Update the WordPress Station Pro plugin to the latest available version at least 2.2.2...
WordPress tcS3 plugin <= 2.1.1 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress tcS3 plugin versios = 2.1.1. Solution 2021-08-27 - no patched version available...