CVE-2021-47857

A flaw was found in Moodle. A remote attacker with privileges to create calendar events could exploit a persistent cross-site scripting XSS vulnerability in the calendar event subtitle field. By injecting malicious JavaScript into the subtitle track label of a crafted calendar event, the attacker...

CVE-2021-47857

Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. Attackers can craft a calendar event with malicious JavaScript in the subtitle track label to execute arbitrary code when users view the...

CVE-2025-52367

Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field...

CVE-2025-52367

Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field...

CVE-2025-52367

Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field...

CVE-2025-52367: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field...

CVE-2025-52367

Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field...

CVE-2025-52367

Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field...

CVE-2025-52367

PivotX CMS version 3.0.0 RC 3 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the title and subtitle fields during page creation. The root cause is a lack of input sanitization in the savePage($page) function in modules/pages_flat.php, where data is stored via saveSerialize() and...

EUVD-2025-30753

Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field...

PT-2025-38986

Name of the Vulnerable Software and Affected Versions PivotX CMS version 3.0.0 RC 3 Description A Cross Site Scripting issue exists in PivotX CMS version 3.0.0 RC 3. This allows a remote attacker to execute arbitrary code through the subtitle field. Recommendations At the moment, there is no...

CVE-2022-1393

The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via wpsubtitle. The subtitle is stored as a custom post meta with the key: "wpssubtitle", which is sanitized upon post save/update, however is not sanitized when updating it directly from th...

WordPress plugin “Add Subtitle” has a cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress Add Subtitle has a cross-site scripting vulnerability that stems from failure to clean up or esca...

PT-2026-3809

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.10.4 Description A security issue exists in Moodle related to insufficient protection of the web page structure within the calendar event subtitle field. Successful exploitation of this issue could allow a remote...

JPress Cross-Site Scripting Vulnerability

JPress is a set of blogging platform developed using the Java language. A cross-site scripting vulnerability exists in JPress version 1.0-rc.5, which can be exploited to inject arbitrary web script or HTML by sending the site name, site title, or site subtitle fields to the...

PT-2018-18076 · Mojoportal · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal versions prior to 2.6.0.0 Description: The issue arises from the software's failure to sanitize user-supplied input, leading to multiple persistent cross-site scripting vulnerabilities. Specifically, the Title and Subtitle fields o...