NoXss

NoXss NoXss is a cross-site script vulnerability scanner supported reflected xss and dom-based xss. It's very fast and suitable for testing millions of urls. It has found some xss vulnerabilities in Bug Bounty program. Features Fast and suitable for testing millions of urls Support Dom-based xssu...

CVE-2021-24891-Simulation

A hands-on, containerized lab environment to simulate and exploit a DOM-based Cross-Site Scripting XSS vulnerability in the Elementor Website Builder WordPress plugin, identified as CVE-2021-24891. 📖 About The Vulnerability This lab demonstrates a DOM-based Cross-Site Scripting XSS vulnerability ...

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

CVE-2026-109895

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29...

CVE-2026-109895

The Arraytics Booktics WordPress plugin (versions n/a through 1.0.29 ) is vulnerable to DOM-Based Cross-site Scripting (XSS) . This security flaw arises from the improper neutralization of input during web page generation, which could allow an attacker to execute malicious scripts in a user's bro...

CVE-2026-109895 WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29...

CVE-2026-109895 WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29...

EUVD-2026-103429

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29...

CVE-2017-7038

CVE-2017-7038 Safari XSS CVE-2017-7038 https://support.apple.com/en-us/HT207923 Document implementation XSS vulnerability var payload = ''; document.createElement'body'.innerHTML = payload; document.implementation.createHTMLDocument.writepayload; new DOMParser.parseFromStringpayload, 'text/html';...

CVE-2024-30956

CVE-2024-30956 cf https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOM-based XSS HTML Injection vulnerability in TOWeb version 5 eg http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP navigate to the url, the JS code is executed PS: src contains a copy ...

CVE-2026-109983

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-109983 YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-109983 YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-109983

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 3.12.19 . The root cause is insufficient input sanitization and output escaping of the 'post_title' parameter. An authenticated attacker with Author-level access or hig...

EUVD-2026-103276

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

WordPress YMC Filter plugin <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Author+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Filter & Grids versions = 3.12.19...

CVE-2021-42558

CVE-2021-42558: Multiple Cross-Site Scripting in MITRE Caldera Caldera versions =2.8.1 contains multiple reflected, stored and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers. Vendor Disclosure: The vendor's disclosure for this vulnerability can be...

Yonyou U8 13.0 - Cross-Site Scripting

Yonyou U8 13.0 contains a DOM-based cross-site scripting vulnerability via the component /u8sl/WebHelp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

Hoppscotch <= 2026.2.1 - Open Redirect

Hoppscotch = 2026.2.1 is vulnerable to a DOM-based open redirect on the /enter page. The redirect query parameter is passed directly to windowz location.href with no origin validation. Requires one additional query parameter to trigger. Exploited via a crafted URL such as...