CVE-2022-0531

The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the subpage parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting...

CVE-2021-24495

The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue...

CVE-2021-37449

Cross Site Scripting XSS exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= reflected...

CVE-2021-37460

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via /planprop?id= reflected...

CVE-2021-24436

The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting XSS security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince ...

CVE-2021-24297

The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tlfilter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting XSS vulnerability...

CVE-2021-24214

The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration...

CVE-2021-21490

SAP NetWeaver AS for ABAP Web Survey, versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in reflected cross site scripting vulnerability, through which a malicious user can access data relating to the current...

CVE-2021-24510

The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue...

CVE-2020-15017

NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...

CVE-2025-31027

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue affects Tiger: from n/a through 2.0...

CVE-2025-31027

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue affects Tiger: from n/a through 2.0...

CVE-2025-39446

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflected XSS.This issue affects Booster Plus for WooCommerce: from n/a through 7.2.4...

CVE-2025-43836 WordPress Syndicate Out <= 0.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in confuzzledduck Syndicate Out allows Reflected XSS.This issue affects Syndicate Out: from n/a through 0.9...

CVE-2025-22687

CVE-2025-22687 describes a Cross‑Site Scripting (Reflected) vulnerability in the WordPress theme Tuaug4 (also listed as WordPress tuaug4). The issue arises from improper input neutralization during web page generation, enabling Reflected XSS when user-supplied input is echoed back in pages. Affec...

CVE-2025-22678

CVE-2025-22678 affects WordPress theme “my white” (my white) up to version 2.0.8. The issue is an Improper Neutralization of Input During Web Page Generation (Reflected XSS). Public documents confirm this vulnerability in my white

WordPress plugin my white 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Wireless Butler 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-43567

Adobe Connect versions 12.8 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containin...

CVE-2025-0687

The CVE-2025-0687 entry covers a reflected Cross-Site Scripting flaw in the WordPress plugin Spiritual Gifts Survey (and S.H.A.P.E. survey) for versions up to 0.9.10. The issue arises because a parameter is not sanitized/escaped before being echoed in the page, allowing a reflected XSS attack tha...