CVE-2024-7090 LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting

The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lhaddmediafromurl-fileurl’ parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2024-6767

The CVE-2024-6767 entry concerns WordSurvey for WordPress and describes a Stored Cross-Site Scripting (XSS) vulnerability via the sounding_title parameter in all versions up to and including 3.2. authenticated attackers with administrator-level access can inject scripts that execute when users lo...

CVE-2024-7134

CVE-2024-7134 affects the LiquidPoll – Polls, Surveys, NPS and Feedback Reviews WordPress plugin. According to the CVE entry, all versions up to and including 3.3.78 are vulnerable to unauthenticated stored cross‑site scripting via the form_data parameter, due to insufficient input sanitization a...

CVE-2024-7134: Improper Neutralization of Input During Web Page Generation

The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘formdata’ parameter in all versions up to, and including, 3.3.78 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-42939

A cross-site scripting XSS vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the configured remarks text field...

CVE-2024-42550: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter...

CVE-2024-7090: Improper Neutralization of Input During Web Page Generation

The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lhaddmediafromurl-fileurl’ parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2024-42550

The Mini Inventory and Sales Management System (commit 18aa3d ) is vulnerable to a cross-site scripting (XSS) flaw in the /email/welcome.php component. An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the Title parameter, potentially leading to malicious c...

CVE-2024-42939

A cross-site scripting XSS vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the configured remarks text field...

CVE-2024-35540

A stored cross-site scripting XSS vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-35540

A stored cross-site scripting XSS vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-42560

The Blood Bank And Donation Management System (commit dc9e039 ) contains a cross-site scripting (XSS) vulnerability within the update_page_details.php component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the Page Details parameter. While the vulnerabi...

CVE-2024-35540

A stored cross-site scripting XSS vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-35540

A stored cross-site scripting XSS vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2024-38047

Name of the Vulnerable Software and Affected Versions The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress versions up to, and including, 1.19.0 Description The issue is related to Stored Cross-Site Scripting via the close text...

CVE-2024-35540

A stored cross-site scripting XSS vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-42560

A cross-site scripting XSS vulnerability in the component updatepagedetails.php of Blood Bank And Donation Management System commit dc9e039 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Details parameter...

CVE-2023-4604 Slideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting via 'post'

The Slideshow, Image Slider by 2J plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘post’ parameter in versions up to, and including, 1.3.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2023-4507 Admission AppManager <= 1.0.0 - Reflected Cross-Site Scripting

The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-7147 JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and including, 1.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...