Spectra < 1.25.6 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC When the admin notice about Usage Tracking is displayed: https://example.com/wp-admin/index?a"...

Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape parameter before outputting it back in a page available to any user both authenticated and unauthenticated when a specific setting is enabled, leading to a Reflected Cross-Site Scripting PoC With the "Compatibility Mode"...

CVE-2022-1527

The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1528

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...

CVE-2022-1009

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin ...

Cross site scripting

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin ...

Cross site scripting

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...

CVE-2022-1528

The CVE-2022-1528 entry affects the VikBooking Hotel Booking Engine & PMS WordPress plugin (before 1.5.9). The vulnerability is a Reflected Cross-Site Scripting caused by not escaping the current URL before embedding it in a JavaScript context, enabling potential script execution. Reported PoCs s...

CVE-2022-1528 VikBooking < 1.5.9 - Reflected Cross-Site Scripting

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...

CVE-2022-1009

The CVE-2022-1009 entry concerns the WordPress Smush plugin (versions before 3.9.9). The vulnerability is a Reflected Cross-Site Scripting caused by the plugin not sanitising/escaping a configuration parameter before outputting it in an admin page when uploading a malicious preset configuration. ...

New User Approve < 2.4.1 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting With the Membership settings /wp-admin/options-general.php disabled: https://example.com/wp-admin/index.php?a"alert/XSS/...

New User Approve < 2.4.1 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC With the Membership settings /wp-admin/options-general.php disabled: https://example.com/wp-admin/index.php?a"...

CVE-2022-1009: Improper Neutralization of Input During Web Page Generation

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin ...

CVE-2022-1528: Improper Neutralization of Input During Web Page Generation

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...

CVE-2022-29091: Improper Neutralization of Input During Web Page Generation

Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in Unisphere GUI. An Unauthenticated Remote Attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a...

CVE-2021-32989

When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...

CVE-2021-32989

When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...

GHSA-JWXH-WJ79-CCM6 Magento Reflected Cross-site Scripting vulnerability via 'file' parameter

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required...

Moodle Vulnerable to Reflected Cross-site Scripting

It was found in Moodle before version 4.0.0-beta that some search inputs were vulnerable to reflected Cross-site Scripting XSS due to insufficient escaping of search queries...

GHSA-XHFX-RM8Q-C3XV Moodle Vulnerable to Reflected Cross-site Scripting

It was found in Moodle before version 4.0.0-beta that some search inputs were vulnerable to reflected Cross-site Scripting XSS due to insufficient escaping of search queries...