1559 matches found
CVE-2021-24976
The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting...
PT-2022-9542
Name of the Vulnerable Software and Affected Versions Smart SEO Tool WordPress plugin versions prior to 3.0.6 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs when the TDK optimisation setting is enabled and the search parameter is not properly sanitised and...
CVE-2021-24976: Improper Neutralization of Input During Web Page Generation
The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting...
CVE-2021-25017: Improper Neutralization of Input During Web Page Generation
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...
PT-2022-9574
Name of the Vulnerable Software and Affected Versions The Tutor LMS WordPress plugin versions prior to 1.9.12 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the search parameter is not properly escaped before being outputted back in an attribute on...
CVE-2021-25016
The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...
PT-2022-9573
Name of the Vulnerable Software and Affected Versions Chaty WordPress plugin versions prior to 2.8.3 Chaty Pro WordPress plugin versions prior to 2.8.2 Description The issue arises from the failure to sanitise and escape the search parameter before outputting it back in the admin dashboard, leadi...
CVE-2021-25016: Improper Neutralization of Input During Web Page Generation
The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...
Smart SEO Tool < 3.0.6 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting PoC With the "TDK optimization" setting enabled 7th page, first one: https://example.com/?s=123456"...
CVE-2020-35037
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in Wordpress Plugin Events Manager, which stems from the...
CVE-2020-35037: Improper Neutralization of Input During Web Page Generation
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues...
Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS
Exploit Title: eShop - Multipurpose Ecommerce / Store Website 3...
CVE-2021-25982
In Factor App Framework & Headless CMS forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...
CVE-2021-25982 FactorJS - Reflected Cross-Site Scripting (XSS) in Search Functionality
In Factor App Framework & Headless CMS forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...
CVE-2021-25982: Improper Neutralization of Input During Web Page Generation
In Factor App Framework & Headless CMS forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...
PT-2021-16905
Name of the Vulnerable Software and Affected Versions Factor App Framework & Headless CMS forum plugin versions 1.3.5 through 1.8.30 Description The issue allows an unauthenticated attacker to execute malicious JavaScript code and steal session cookies through reflected Cross-Site Scripting XSS a...
Darwin Factor 跨站脚本漏洞
Darwin Factor is a free and open source next-generation TypeScript framework from Darwin, Inc. Darwin Factor has a cross-site scripting vulnerability that stems from vulnerability to search parameter reflection cross-site scripting XSS attacks in URLs, which can be exploited by unauthenticated...
