10572 matches found
Cross site scripting
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled...
Cross site scripting
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting...
CVE-2022-2181
The CVE-2022-2181 issue affects the WordPress plugin Advanced WordPress Reset, specifically versions prior to 1.6. The vulnerability arises because some generated URLs are not properly escaped before being output in href attributes on admin dashboard pages, enabling Reflected XSS. The documented ...
CVE-2022-1906 Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled...
CVE-2022-1906: Improper Neutralization of Input During Web Page Generation
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled...
Multiple Plugins from Puvox.software - Reflected Cross-Site Scripting
The plugins do not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=wp-phpmyadmin-extension=errors-logreset"...
CVE-2022-2181: Improper Neutralization of Input During Web Page Generation
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting...
PT-2022-15145 · WordPress · Advanced Wordpress Reset
Name of the Vulnerable Software and Affected Versions: Advanced WordPress Reset WordPress plugin versions prior to 1.6 Description: The issue concerns Reflected Cross-Site Scripting. It occurs because some generated URLs are not properly escaped before being outputted back in href attributes of...
VR Calendar < 2.3.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/plugins.php?vrcmsg=msgtype="...
EUVD-2022-6260
Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting XSS vulnerability...
CVE-2022-34991
Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...
Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-Scripting
The plugin does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file PoC Direct call:...
VulnCheck KEV: CVE-2022-2383
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting PoC Both can be used against authenticated and unauthenticated users https://example.com/wp-admin/admin-ajax.php?action=ftsrefreshtokenajaxtoken=...
Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting PoC Against any authenticated user: https://example.com/wp-admin/admin-ajax.php?action=ftsencrypttokenajaxtoken=%3Cimg%20src=x%20onerror=alert/XSS/%3E...
UBUNTU-CVE-2022-35653
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...
CVE-2022-2115
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting...
CVE-2022-0899
The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting...
CVE-2022-2072
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...