KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)

Reflective Cross Site Scripting XSS vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APPHOST parameter at config/i18n/en/main.php. id: CVE-2023-49489 info: name: KodeExplorer 4.51 - Reflective Cross Site Scripting XSS...

Astro cross-site scripting vulnerability

Versions prior to Astro 7.3.2 contain a cross-site scripting vulnerability. This vulnerability arises because the JSX and MDX rendering pipelines treat string sub-elements within script and style elements as trusted HTML, failing to distinguish between text content generated by the compiler and...

ProjectDiscovery Nuclei Templates Cross-Site Script Vulnerabilities

Versions of ProjectDiscovery Nuclei Templates prior to 1.1.1 contained a cross-site scripting vulnerability. This vulnerability stemmed from uncleaned input of the ff parameter, making it susceptible to reflective cross-site scripting attacks. Such attacks could execute scripts and steal session...

jcrodriguez-dis Virtual Programming Lab for Moodle Cross-Site Script Vulnerabilities

The jcrodriguez-dis Virtual Programming Lab for Moodle versions prior to 5.0.0 has a cross-site scripting vulnerability. This vulnerability stems from the unencoded filename1/filename2 parameters in the similarity/diff.php file. It may lead to reflective cross-site scripting attacks. Attackers ca...

WordPress Custom Tables: Cross-site Scripting Vulnerabilities

Versions of WordPress Custom Tables prior to 3.4.6 contained a cross-site scripting vulnerability. This vulnerability stemmed from the uncleaned key parameter in the iframe.php file. It could lead to reflective XSS attacks. Unauthenticated attackers could construct GET requests to execute scripts...

WordPress Tutor LMS Cross-site Scripting Vulnerability

WordPress Tutor LMS versions 4.1.0 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'tab' parameter. Additionally, when the nav-items array of the target course page is empty, the inarray validation can be...

WordPress Payment Plugins for Stripe: WooCommerce Cross-Site Script Vulnerabilities

WordPress payment plugins for Stripe and WooCommerce versions 4.0.17 and earlier have a cross-site scripting vulnerability. This vulnerability stems from the use of the “response” URL fragment to trigger reflective cross-site scripting. The issue arises due to improper input cleaning and output...

WordPress WPForms cross-site scripting vulnerabilities

WordPress WPForms 2.0.2.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper handling of parameters referenced by smart tags, particularly in the cleanup of attacker-controlled key inputs and output escaping. It may lead to reflective cross-site...

DedeCMS v5.7.111 - Cross-Site Scripting Detection

DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting XSS vulnerability via the component selectmediapostwangEditor.php. !/usr/bin/env python3 -- coding: utf-8 -- """DedeCMS v5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS) Detection

Reflective Cross Site Scripting XSS vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APPHOST parameter at config/i18n/en/main.php. !/usr/bin/env python3 -- coding: utf-8 -- """Reflective Cross Site Scripting XSS...

CVE-2026-63264: Improper Neutralization of Input During Web Page Generation

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

WordPress plugin NS Product icon badge: Cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

VulnCheck KEV: CVE-2022-28290

Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request...

WordPress’s various products have cross-site scripting vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...

xss

CSS Style Sheet Mutation alert"This is a test" alert"...

Semantic MediaWiki cross-site scripting vulnerability

Semantic MediaWiki is an open-source extension of Semantic MediaWiki that stores and queries data within wiki pages. Semantic MediaWiki has a cross-site scripting vulnerability. This vulnerability stems from the endpoint parameters in /index.php/Speciaal:GefacetteerdZoeken, which allow for...

CVE-2026-31859 Craft has Reflective XSS via incomplete return URL sanitization

Craft is a content management system CMS. The fix for CVE-2025-35939 in craftcms/cms introduced a striptags call in src/web/User.php to sanitize return URLs before they are stored in the session. However, striptags only removes HTML tags angle brackets -- it does not inspect or filter URL schemes...

CVE-2026-31859 Craft has Reflective XSS via incomplete return URL sanitization

Craft is a content management system CMS. The fix for CVE-2025-35939 in craftcms/cms introduced a striptags call in src/web/User.php to sanitize return URLs before they are stored in the session. However, striptags only removes HTML tags angle brackets -- it does not inspect or filter URL schemes...

WordPress Plugin: DesignThemes Core Features – Security Vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. WordPress...

WordPress plugin Vzaar Media Management has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...