Gravity PDF < 6.3.1 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=gfeditforms&view=settings&subview=pdf&id=1&a'alert/XSS/...

CVE-2022-1773

The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1604

The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1820

The CVE-2022-1820 entry concerns the WordPress plugin Keep Backup Daily. Affected versions up to and including 2.0.2 are vulnerable to Reflected Cross-Site Scripting via the t parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitr...

CVE-2022-1773

The CVE-2022-1773 entry concerns the WP Athletics WordPress plugin (versions up to 1.1.7). The vulnerability arises because the plugin does not sanitize and escape a parameter before echoing it on an admin page, enabling a Reflected Cross-Site Scripting (XSS) attack. Several connected sources con...

CVE-2022-1773 WP Athletics <= 1.1.7 - Reflected Cross-Site Scripting

The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1756 Newsletter < 7.4.5 - Reflected Cross-Site Scripting

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...

CVE-2022-1532 Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site Scripting

Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0626

CVE-2022-0626 affects the WordPress plugin Advanced Admin Search prior to version 1.1.6. The issue is a Reflected Cross-Site Scripting caused by parameters not being sanitized/escaped before being output on an admin page (e.g., keyword, user, metaKey, metaValue). A fix is available in version 1.1...

CVE-2022-1822 Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting

The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2017-20044 Navetti PricePoint Reflected cross site scriting

A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to basic cross site scripting Reflected. It is possible to initiate the attack remotely. Upgrading to version 4.7.0.0 is able to address this issue...

Gallery < 2.0.0 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue PoC...

CVE-2022-1985: Improper Neutralization of Input During Web Page Generation

The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the /src/Package/views/shortcode-iframe.php file...

CVE-2022-1773: Improper Neutralization of Input During Web Page Generation

The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting...

PT-2022-14139 · WordPress · Keep Backup Daily

Name of the Vulnerable Software and Affected Versions: The Keep Backup Daily plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to Reflected Cross-Site Scripting via the t parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2022-1604: Improper Neutralization of Input During Web Page Generation

The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

WordPress Grow Social plugin <= 1.18.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Grow Social plugin versions = 1.18.2. Solution Update the WordPress Grow Social plugin to the latest available version at least 1.19.0...

CVE-2022-0626: Improper Neutralization of Input During Web Page Generation

The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting...

Reflected Cross-Site Scripting (XSS)

facturascripts/facturascripts is vulnerable to reflected cross-site scripting XSS attacks. A malicious user is able to inject and execute arbitrary javascript through the codbalance parameter in test function in Balance.php file, which could lead to compromised user accounts/devices...