CVE-2024-8662

The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3.12. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary...

Elaine's Realtime CRM Automation 6.18.17 Cross Site Scripting

Exploit Title: Reflected XSS in Elaine's Realtime CRM Automation v6.18.17 Date: 09/2024 Exploit Author: Haythem Arfaoui CBTW Team Vendor Homepage: https://www.elaine.io/ Software Link: https://www.elaine.io/en/products/elaine-marketing-automation/ Version: 6.18.17 and below Tested on: Windows,...

PT-2024-39196 · WordPress · Xt Ajax Add To Cart For Woocommerce

Name of the Vulnerable Software and Affected Versions: XT Ajax Add To Cart for WooCommerce plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...

CVE-2024-7785 Reflected XSS in Ece Software's Electronic Ticket System

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting XSS. This issue affects Electronic Ticket System: before 2024.08...

CVE-2024-7785 Reflected XSS in Ece Software's Electronic Ticket System

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting XSS. This issue affects Electronic Ticket System: before 2024.08...

GHSA-R9CR-QMFW-PMRC Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)

A stored cross-site scripting has been found in the image upload functionality that can be used by normal registered users: It is possible to upload a SVG image containing JavaScript and it's also possible to upload a HTML document when the format parameter is manually changed to documents or a...

CVE-2024-6877 Reflected XSS in Eliz Software's Panel

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Eliz Software Panel allows Reflected XSS. This issue affects Panel: before v2.3.24...

CVE-2024-6877

The CVE describes a Reflected Cross-Site Scripting (XSS) vulnerability in Eliz Software Panel (Eliz Software Panel). Affected are versions prior to 2.3.24, where improper neutralization of input during web page generation enables reflection-based XSS. The issue’s technical context is the failure ...

CVE-2024-6877 Reflected XSS in Eliz Software's Panel

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Eliz Software Panel allows Reflected XSS. This issue affects Panel: before v2.3.24...

CVE-2024-44003

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through = 1.2.5...

CVE-2024-43971

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through = 3.2.5...

CVE-2024-44003 WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through = 1.2.5...

CVE-2024-44007

CVE-2024-44007 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin “SKT Templates – Elementor & Gutenberg templates” (SKT Templates) up to version 6.14. The issue arises from improper input neutralization during web page generation, enabling reflected XSS. Publi...

CVE-2024-44053

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Mohammad Arif Opor Ayam allows Reflected XSS.This issue affects Opor Ayam: from n/a through 1.8...

CVE-2024-45458

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through = 4.9.13...

CVE-2024-44060 WordPress filmix theme <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Jennifer Hall Filmix allows Reflected XSS.This issue affects Filmix: from n/a through 1.1...

CVE-2024-8797

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers...

CVE-2024-8732

The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-8730

The Exit Notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...