CVE-2026-5293

The 診断ジェネレータ作成プラグイン Diagnosis Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc function. The function is hooke...

CVE-2026-5293: Improper Neutralization of Input During Web Page Generation

The 診断ジェネレータ作成プラグイン Diagnosis Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc function. The function is hooke...

CVE-2025-14635

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hapagecustomjs' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-35020 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.23 Description: The issue is related to Stored Cross-Site Scripting via the custom js parameter due to insufficient input sanitization and output...

CVE-2024-1348: Improper Neutralization of Input During Web Page Generation

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2024-17962 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.15.5 Description: The issue is related to Stored Cross-Site Scripting via the custom JS parameter due to insufficient input sanitization and...

CVE-2023-6645: Improper Neutralization of Input During Web Page Generation

The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

Code injection

WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the 1 js or 2 cat parameter...

CVE-2014-5114: Undefined Security Weakness

WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the 1 js or 2 cat parameter...

CVE-2009-3149: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in css/js.php in Elgg 1.5, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the js parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-6290: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in js/getjs.php in SERWeb 2.0.0 dev1 and earlier allow remote attackers to read arbitrary files via a .. dot dot in the 1 mod and 2 js parameters...

CVE-2006-6366

Cerberus Helpdesk is affected by a Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php. The js parameter can be exploited to inject arbitrary script/HTML in versions 0.97.3, 2.0–2.7, 3.2.1, and 3.3. This is a remote issue described in the CVE entry; exploitation ...

CVE-2006-6366: Undefined Security Weakness

Cross-site scripting XSS vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details ar...