Cross site scripting

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a...

Cross site scripting

The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user both authenticated and unauthenticated when a specific setting is enabled, leading to a Reflected Cross-Site Scripting...

CVE-2022-1916 Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-Scripting

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a...

CVE-2022-1904 Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting

The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user both authenticated and unauthenticated when a specific setting is enabled, leading to a Reflected Cross-Site Scripting...

WordPress miniOrange's Google Authenticator plugin <= 5.5.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress miniOrange's Google Authenticator plugin versions = 5.5.7. Solution Update the WordPress miniOrange's Google Authenticator plugin to the latest available version at least 5.5.75...

CVE-2022-1470: Improper Neutralization of Input During Web Page Generation

The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

miniOrange's Google Authenticator < 5.5.75 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=mo2fatwofa"...

Woo Discount Rules < 2.4.2 - Reflected Cross-Site Scripting

The plugin does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=woodiscountrules&name="+style=animation-name:rotation+onanimationstart=alert/XSS///...

Download Manager < 3.2.44 - Reflected Cross-Site Scripting

The plugin does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/edit.php?posttype=wpdmpro=wpdm-stats=historyids=1&"...

Download Manager < 3.2.44 - Unauthenticated Reflected Cross-Site Scripting

The plugin does not escape a generated URL before outputting it back in an attribute of the login page made by the plugin, leading to Reflected Cross-Site Scripting, which is only exploitable against unauthenticated users On the login page from the plugin ie where the wpdmloginform is embed, appe...

CVE-2022-1904: Improper Neutralization of Input During Web Page Generation

The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user both authenticated and unauthenticated when a specific setting is enabled, leading to a Reflected Cross-Site Scripting...

Woo Discount Rules < 2.4.2 - Reflected Cross-Site Scripting

The plugin does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=woodiscountrules="+style=animation-name:rotation+onanimationstart=alert/XSS///...

Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting

The plugin does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=advanceddbcleaner&aDBctab=cron&aDBccat=all&"alert/XSS/ Other pages are affected...

CVE-2022-29931

The administration interface of the Raytion Custom Security Manager Raytion CSM in Version 7.2.0 allows reflected Cross-site Scripting XSS...

CVE-2022-29931

CVE-2022-29931 affects Raytion Custom Security Manager (CSM) administration interface in version 7.2.0, where a reflected Cross-site Scripting (XSS) vulnerability exists. The vulnerability arises in the admin UI and could allow injection of malicious scripts into the browser for victims visiting ...

PT-2022-19915 · Raytion · Raytion Custom Security Manager

Name of the Vulnerable Software and Affected Versions: Raytion Custom Security Manager version 7.2.0 Description: The administration interface of the Raytion Custom Security Manager allows reflected Cross-site Scripting XSS. This issue can be exploited through the administration interface,...

GHSA-39R3-H8Q6-2PHQ Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin

Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting XSS vulnerability. Embeddable Build Status Plugin 2.0.4 limits URLs to http and https...

CVE-2022-31786

IdeaLMS 2022 allows reflected Cross Site Scripting XSS via the IdeaLMS/Class/Assessment/ PATHINFO...

CDI < 5.1.9 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting...

Import CSV Files <= 1.0 - Reflected Cross-Site Scripting

The plugin does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting PoC...