149 matches found
CVE-2021-38330
The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /yabp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4...
CVE-2021-38337
The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1...
CVE-2021-38336
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...
CVE-2021-38335
The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...
CVE-2021-38337 RSVPMaker Excel <= 1.1 Reflected Cross-Site Scripting
The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1...
PT-2021-22056
Name of the Vulnerable Software and Affected Versions: RSVPMaker Excel WordPress plugin versions up to and including 1.1 Description: The issue is related to Reflected Cross-Site Scripting, which occurs due to a reflected $ SERVER"PHP SELF" value in the...
PT-2021-22046
Name of the Vulnerable Software and Affected Versions: Notices WordPress plugin versions up to and including 6.1 Description: The issue concerns a Reflected Cross-Site Scripting vulnerability. It is caused by a reflected $ SERVER"PHP SELF" value in the /notices.php file, allowing attackers to...
PT-2021-22054
Name of the Vulnerable Software and Affected Versions: Wise Agent Capture Forms WordPress plugin versions up to and including 1.0 Description: The issue allows attackers to inject arbitrary web scripts due to a reflected $ SERVER"PHP SELF" value in the /WiseAgentCaptureForm.php file. This enables...
PT-2021-22055
Name of the Vulnerable Software and Affected Versions: Edit Comments XT WordPress plugin versions up to and including 1.0 Description: The issue allows attackers to inject arbitrary web scripts due to a reflected $ SERVER"PHP SELF" value in the /edit-comments-xt.php file. This enables Reflected...
WordPress plugin cross-site scripting vulnerabilities
WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin WP Scrippets 1.5.1 and earlier versions, which stems from a lack of valid validation and escaping of the $SERVER"PHPSELEF" value in /wp-scrippets. An attacker...
PT-2021-22532
Name of the Vulnerable Software and Affected Versions: Easy Social Icons plugin versions 3.0.8 and earlier Description: The issue allows for a reflected Cross-Site Scripting attack by injecting malicious code in the request path on certain configurations, including Apache+modPHP. This is possible...
CVE-2021-39320
The underConstruction plugin = 1.18 for WordPress echoes out the raw value of $GLOBALS'PHPSELF' in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the...
PT-2021-22530
Name of the Vulnerable Software and Affected Versions: underConstruction plugin versions = 1.18 for WordPress Description: The issue allows for a reflected Cross-Site Scripting attack by injecting malicious code in the request path on certain configurations, including Apache+modPHP. This is...
CVE-2021-34667
The Calendarplugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /calendar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...
CVE-2021-34663
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...
CVE-2021-34653
The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...
PT-2021-20626
Name of the Vulnerable Software and Affected Versions: Simple Popup Newsletter WordPress plugin versions up to and including 1.4.7 Description: The issue is related to Reflected Cross-Site Scripting due to the use of $ SERVER'PHP SELF' in the /simple-popup-newsletter.php file, allowing attackers ...
PT-2018-10043
Name of the Vulnerable Software and Affected Versions ILIAS version 5.3.4 Description The issue is related to an XSS vulnerability due to unsanitized output of PHP SELF, specifically affecting files such as shib logout.php and certain third-party demo files. Recommendations For ILIAS version 5.3....
CVE-2017-1000428
flatCore-CMS 1.4.6 is vulnerable to reflected XSS in usermanagement.php due to the use of $SERVER'PHPSELF' to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string...