Cross site scripting

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24813: Improper Neutralization of Input During Web Page Generation

The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24789: Improper Neutralization of Input During Web Page Generation

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24773: Improper Neutralization of Input During Web Page Generation

The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24722: Improper Neutralization of Input During Web Page Generation

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24715: Improper Neutralization of Input During Web Page Generation

The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-8380

Name of the Vulnerable Software and Affected Versions WP-Stats WordPress plugin versions prior to 2.52 Description The issue allows an attacker to make logged-in high-privilege users change settings and set Cross-Site Scripting payloads due to the lack of a CSRF check when saving settings and the...

PT-2021-16218

Name of the Vulnerable Software and Affected Versions WP Sitemap Page WordPress plugin versions prior to 1.7.0 Description The issue arises from the plugin's failure to properly sanitise and escape some of its settings. This could allow high privilege users to perform Cross-Site Scripting attacks...

PT-2021-16270

Name of the Vulnerable Software and Affected Versions: WordPress Download Manager versions prior to 3.2.16 Description: The issue allows high privilege users to perform XSS attacks even when the unfiltered html capability is disallowed, due to the plugin not escaping some of the Download settings...

PT-2021-16225

Name of the Vulnerable Software and Affected Versions The Restaurant Menu by MotoPress WordPress plugin versions prior to 2.4.2 Description The issue concerns a lack of proper sanitization or escaping of inputs when creating new menu items, potentially allowing high-privilege users to perform...

CVE-2021-24794: Improper Neutralization of Input During Web Page Generation

The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfilteredhtml capability is disallowed...

PT-2021-16283

Name of the Vulnerable Software and Affected Versions: Flat Preloader WordPress plugin versions prior to 1.5.5 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping some of its settings when outputting them in attributes in the...

Shop Page WP < 1.2.8 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Add/edit a product and put the following payload in the Product Affiliate URL, Custom Button Text...

CVE-2021-24624: Improper Neutralization of Input During Web Page Generation

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks...

CVE-2021-24793: Improper Neutralization of Input During Web Page Generation

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16288

Name of the Vulnerable Software and Affected Versions: WPeMatico RSS Feed Fetcher WordPress plugin versions prior to 2.6.12 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the Feed URL added to a campaign not being escaped before outputting it in ...

CVE-2021-37364

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would...

CVE-2021-24744

The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24785

The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24785

The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...