222 matches found
CVE-2023-0948
The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...
CVE-2023-1373
The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...
CVE-2022-1528
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...
CVE-2025-2635
The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg function without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2025-2166
The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated...
CVE-2025-2166 CM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scripting
The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated...
WordPress plugin CM FAQ 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-13827
CVE-2024-13827 affects Razorpay Subscription Button Elementor Plugin for WordPress (versions up to 1.0.3). The vulnerability is a reflected XSS caused by insufficient escaping in add_query_arg()/remove_query_arg() usage. Publicly available sources in connected documents confirm the issue and indi...
CVE-2024-11376
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 241114...
CVE-2024-13347 Essential WP Real Estate <= 1.1.3 - Reflected XSS
The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...
CVE-2024-12400
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...
CVE-2024-13319
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...
CVE-2024-11328 CLUEVO LMS, E-Learning Platform <= 1.13.2 - Reflected Cross-Site Scripting
The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.13.2. This makes it possible for unauthenticated attackers to...
CVE-2024-9208 Enable Accessibility <= 1.4.1 - Reflected Cross-Site Scripting
The Enable Accessibility plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2024-9208
The CVE-2024-9208 issue affects the WordPress Enable Accessibility plugin (versions up to and including 1.4.1). It describes a Reflected Cross-Site Scripting vulnerability caused by insufficient escaping when using add_query_arg and remove_query_arg in the URL, enabling unauthenticated attackers ...
CVE-2024-11375
CVE-2024-11375 affects the WC1C WordPress plugin. The vulnerability is a Reflected Cross-Site Scripting (XSS) in which add_query_arg is used without proper escaping, present in all versions up to and including 0.23.0. This allows unauthenticated attackers to craft a link that, if a user is convin...
CVE-2024-11287
CVE-2024-11287 – Ebook Store (WordPress) Reflected XSS Affected software: Ebook Store WordPress plugin, versions up to and including 5.8001. Root cause and impact: Reflected Cross-Site Scripting due to insufficient escaping when using add_query_arg on the URL, enabling unauthenticated attackers t...
CVE-2024-12160
The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject...
CVE-2024-12072
The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject...