CVE-2022-1436 WPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargotrackingnumber parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks...

CVE-2022-1267 BMI BMR Calculator <= 1.3 - Reflected Cross-Site Scripting

The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting...

CVE-2022-1216: Improper Neutralization of Input During Web Page Generation

The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHPSELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting...

CVE-2022-1465: Improper Neutralization of Input During Web Page Generation

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue...

WordPress WPify Woo Czech plugin <= 3.5.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress WPify Woo Czech plugin versions = 3.5.6. Solution Update the WordPress WPify Woo Czech plugin to the latest available version at least 3.5.7...

CVE-2022-1217: Improper Neutralization of Input During Web Page Generation

The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHPSELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting...

WordPress Ask Me premium theme < 6.8.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Veshraj Ghimire in WordPress Ask Me premium theme versions 6.8.2. Solution Update the WordPress Ask Me premium theme to the latest available version at least 6.8.2...

CVE-2022-1267: Improper Neutralization of Input During Web Page Generation

The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting...

Cross-Site Request Forgery (CSRF) vulnerability in Jenkins global-build-stats plugin

Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting...

Cross-site Scripting (XSS)

facturascripts/facturascripts is vulnerable to reflected cross-site scripting. The vulnerability exists in the privateCore function of EditPageOption.php' due to the lack of sanitization which allows an attacker to inject and execute malicious javascript...

TIBCO Security Advisory: May 17, 2022 - TIBCO JasperReports Server -CVE-2022-22773

TIBCO JasperReports Server Reflected Cross Site Scripting XSS vulnerability Original release date: May 17,2022 Last revised: --- CVE-2022-22773 Source: TIBCO Software Inc. Products Affected TIBCO JasperReports Server versions 8.0.1 and below TIBCO JasperReports Server - Community Edition versions...

Quick Restaurant Reservations < 1.4.2 - Reflected Cross-Site Scripting

The plugin does not escape some parameters before outputting them back in admin pages, leading to Reflected Cross-Site Scripting...

CVE-2022-28078

Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET'page' parameter...

CVE-2022-28078

Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET'page' parameter...

CVE-2022-29975

An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0...

CVE-2022-29975

An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0...

CVE-2022-29976

An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0...

WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout page

The plugin does not escape the errorenvision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability. PoC 1. Enable greenwallet-gateway as a woocommerce payment gateway 2. add something in your cart and visit the checkout page 3. visit...

CVE-2022-1567

The WP-JS plugin for WordPress contains a script called wp-js.php with the function wpjsadmin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6...

CVE-2022-1567

The CVE-2022-1567 entry concerns the WP-JS WordPress plugin. The wp-js.php script contains the wp_js_admin function which accepts unvalidated user input and echoes it back, enabling reflected Cross-Site Scripting in plugin versions up to and including 2.0.6. The affected component is the wp-js.ph...