CVE-2021-25120

The CVE-2021-25120 affects the WordPress plugins Easy Social Feed Free/Pro prior to version 6.2.7. Affected component: parameters used via AJAX actions that are not sanitized before being reflected in responses, enabling a reflected Cross-Site Scripting (XSS) condition. The issue can execute Java...

CVE-2022-27422

A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...

CVE-2020-25158 B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus

A reflected cross-site scripting XSS vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations...

CVE-2022-22181

CVE-2022-22181 is a reflected XSS in Juniper Junos OS J-Web. Affected: Junos OS versions prior to 18.3R3-S5; 18.4 before 18.4R3-S9; 19.1 before 19.1R3-S6; 19.2 before 19.2R3-S3; 19.3 before 19.3R2-S6, 19.3R3-S3; 19.4 before 19.4R3-S5; 20.1 before 20.1R3-S4; 20.2 before 20.2R3-S2; 20.3 before 20.3...

Uber: Full read SSRF in flyte-poc-us-east4.uberinternal.com

Uber summary TBD. @shubs and I discovered an instance of Flyte Console on uberinternal.com. After auditing the open source code, we noticed an unauthenticated route for a “CORS proxy”. This was a classic server-side request forgery issue, allowing us to pass an arbitrary request to be performed b...

CVE-2022-27505

Reflected cross site scripting XSS...

Admin Menu Editor <= 1.0.4 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. https://example.com/wp-admin/options-general.php?page=admin-menu-restriction&role="...

CVE-2021-36914

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...

CVE-2021-36914

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...

CVE-2021-36914 WordPress CalderaWP License Manager plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...

PT-2022-10605 · Calderawp · Calderawp License Manager

Name of the Vulnerable Software and Affected Versions: CalderaWP License Manager versions prior to 1.2.12 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that can lead to Reflected Cross-Site Scripting XSS. This means an attacker could potentially trick a user into...

Themify - Post Type Builder Search Addon < 1.4.0 - Reflected Cross-Site Scripting

The plugin does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability. PoC On a page or post with a search form, add the following url query parameter: ?%22%3E%3Cscript%3Ealert1%3C/script%3E...

CalderaWP License Manager <= 1.2.11 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back, leading to a Reflected Cross-Site Scripting...

CVE-2022-0892

The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0314

The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1007

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0314

The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lpbackgroundsingleemail AJAX action, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the posttypes parameter before outputting it back in the response of the postgridupdatetaxonomiestermsbyposttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting...