CVE-2021-24591: Improper Neutralization of Input During Web Page Generation

The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Highlight < 0.9.3 - Authenticated Stored Cross-Site Scripting

The plugin does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Tick the "Enable Highlight" setting of the plugin, and put the following payload in the CustomCSS setting as well:...

PT-2015-5670

Name of the Vulnerable Software and Affected Versions WonderPlugin Audio Player plugin version 2.0 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can...