237 matches found
CVE-2024-43971
CVE-2024-43971 refers to WP Sunshine Sunshine Photo Cart (WordPress) versions up to 3.2.5 and describes a reflected XSS caused by improper input neutralization during web page generation. Exploitation requires an attacker to craft malicious input, enabling execution of arbitrary scripts in a user...
CVE-2024-23906
CVE-2024-23906 affects Gallagher Controller 6000 and Controller 7000. The flaw is Improper Neutralization of Input During Web Page Generation (CWE-79) in the diagnostic webpage, allowing an attacker to modify controller configuration during an authenticated Operator’s session. The issue impacts m...
CVE-2024-43920
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Jegstudio Gutenverse allows Stored XSS.This issue affects Gutenverse: from n/a through 1.9.4...
CVE-2024-43950
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Nextbricks Brickscore allows Stored XSS.This issue affects Brickscore: from n/a through 1.4.2.5...
CVE-2024-43284
CVE-2024-43284 : Affects the WordPress plugin WP Travel Gutenberg Blocks (Stored XSS). The vulnerability is in WP Travel Gutenberg Blocks versions up to 3.5.1 (n/a to 3.5.1) and stems from Improper Neutralization of Input During Web Page Generation. Impact is stored cross-site scripting (XSS) as ...
CVE-2024-43313
CVE-2024-43313 describes an XSS vulnerability in the WordPress plugin FormFacade (Google Forms) via Reflected XSS due to improper input neutralization during web page generation. Affected versions are listed as from n/a through 1.3.2. The issue’s root cause is improper input handling in the web p...
CVE-2024-43320
CVE-2024-43320 is a stored XSS vulnerability in Livemesh Addons for WPBakery Page Builder (WPBakery Addons by Livemesh). Affected: Livemesh Addons for WPBakery Page Builder (up to and including 3.9). Root cause: Improper neutralization of input during web page generation. Impact statements are li...
CVE-2024-38724
Cross-Site Request Forgery CSRF, Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Muhammad Rehman Contact Form 7 Summary and Print allows Stored XSS.This issue affects Contact Form 7 Summary and Print: from n/a through 1.2.5...
CVE-2024-38724
CVE-2024-38724 affects the WordPress plugin Contact Form 7 Summary and Print (versions up to 1.2.5). The issue combines Cross-Site Request Forgery (CSRF) and an input handling flaw that enables Stored XSS during web page generation. The description indicates Stored XSS can be triggered via the pl...
CVE-2024-35775
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Authentication vulnerability in Soliloquy Team Slider by Soliloquy allows Cross-Site Scripting XSS.This issue affects Slider by Soliloquy: from n/a through 2.7.6...
CVE-2024-43216
The CVE CVE-2024-43216 targets Filr – Secure document library (WordPress plugin). It reports improper input neutralization leading to stored XSS in web page generation, affecting Filr library versions from n/a up to 1.2.4. The issue is categorized as Stored XSS with impact limited to confidential...
CVE-2024-43225
CVE-2024-43225 affects Enter Addons (WordPress plugin for Elementor). Evidence in connected data shows a Stored Cross-Site Scripting vulnerability that is exploitable by authenticated users (Contributor+). Root cause reported in multiple sources points to improper handling/neutralization of input...
Open WebUI 0.1.105 Persistent Cross Site Scripting
KL-001-2024-005: Open WebUI Stored Cross-Site Scripting Title: Open WebUI Stored Cross-Site Scripting Advisory ID: KL-001-2024-005 Publication Date: 2024.08.06 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-005.txt 1. Vulnerability Details Affected Vendor: Open WebUI...
CVE-2024-37259
CVE-2024-37259 affects The Ultimate WordPress Toolkit – WP Extended (WP Extended) plugin. Public sources describe Cross-Site Scripting (XSS) in WP Extended up to version 2.4.7, with varying classifications across sources: the NVD entry cites Reflected XSS, while other connected templates discuss ...
CVE-2024-38786
CVE-2024-38786 is a Stored XSS vulnerability in the WordPress theme CoziPress (BurgerThemes) due to improper neutralization during web page generation. Affected versions are listed as CoziPress ≤ 1.0.30. Public details in the connected documents do not provide a confirmed patch or fixed version; ...
CVE-2024-37509
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Maksekeskus AS MakeCommerce for WooCommerce allows Reflected XSS.This issue affects MakeCommerce for WooCommerce: from n/a through 3.5.1...
CVE-2024-37489
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OceanWP Ocean Extra allows Stored XSS.This issue affects Ocean Extra: from n/a through 2.2.9...
CVE-2024-37495
CVE-2024-37495 is a Stored XSS in Mediavine Create for WordPress, caused by improper neutralization of input during web page generation. Affected: Create by Mediavine versions n/a through 1.9.7. The vulnerability is documented as a cross-site scripting issue that stores user input and could affec...
CVE-2024-37545
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Nick Halsey Floating Social Media Links allows Stored XSS.This issue affects Floating Social Media Links: from n/a through 1.5.2...