Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the QUERYSTRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters PoC GET /wp-admin/admin.php?page=GOTMLSViewQuarantine=" HTTP/1.1 Cache-Control: max-age=0...

CVE-2022-0641

The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the aysfbtab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0600

The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25012

The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues...

Cross site scripting

The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the posttype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the aysfbtab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmurspid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlistquickview AJAX action's response available to any authenticated user, leading to a Reflected Cross-Site Scripting...

CVE-2022-0647

CVE-2022-0647 concerns the WordPress plugin Bulk Creator (versions up to 1.0.1). The vulnerability is a straightforward Reflected Cross-Site Scripting caused by the plugin failing to sanitize and escape the post_type parameter before echoing it back on an admin page. The root cause, as described ...

CVE-2022-0647 Bulk Creator <= 1.0.1 - Reflected Cross-Site Scripting

The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the posttype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0641 Popup Like box < 3.6.1 - Reflected Cross-Site Scripting

The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the aysfbtab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0621

The CVE-2022-0621 case concerns the WordPress dTabs plugin (versions ≤ 1.4). The vulnerability arises because the tab parameter is not sanitized/escaped before being echoed in an admin page, causing a Reflected Cross-Site Scripting (XSS) condition. Affected component: dTabs plugin’s admin output ...

CVE-2022-0620 Delete Old Orders <= 0.2 - Reflected Cross-Site Scripting

The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0619 Database Peek <= 1.2 - Reflected Cross-Site Scripting

The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0600 Conference Scheduler < 2.4.3 - Reflected Cross-Site Scripting

The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0397 WPC Smart Wishlist for WooCommerce < 2.9.4 - Reflected Cross-Site Scripting

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlistquickview AJAX action's response available to any authenticated user, leading to a Reflected Cross-Site Scripting...

CVE-2022-0397

The CVE-2022-0397 entry concerns the WordPress plugin WPC Smart Wishlist for WooCommerce (versions prior to 2.9.4). The issue is a lack of sanitisation/escaping of the key parameter in the wishlist_quickview AJAX response, which can lead to a Reflected Cross‑Site Scripting vulnerability accessibl...

Modern Events Calendar Lite < 6.4.7 - Reflected Cross-Site Scripting

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC On a page where the Total Booking widget is displayed, append the following payload: "...

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

The plugin does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting PoC The issue is only exploitable when there are no forms created yet...

PT-2022-13303 · WordPress · Database Peek

Name of the Vulnerable Software and Affected Versions: Database Peek WordPress plugin versions prior to 1.3 Description: The issue arises from the lack of proper sanitization and escaping of the match parameter, which is then outputted back in an admin page. This leads to a Reflected Cross-Site...