10572 matches found
CVE-2022-1567 WP JS <= 2.0.6 - Reflected Cross-Site Scripting
The WP-JS plugin for WordPress contains a script called wp-js.php with the function wpjsadmin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6...
WP Statistics < 13.2.2 - Reflected Cross-Site Scripting
The plugin does not sanitise the REQUESTURI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting XSS in web browsers which do not encode characters PoC GET /wp-admin/admin.php?page=wpssettingspage= HTTP/1.1 Accept:...
CVE-2022-1047
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability...
CVE-2022-1047 Themify - Post Type Builder Search Addon < 1.4.0 - Reflected Cross-Site Scripting
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability...
CVE-2022-0625
The CVE-2022-0625 entry concerns the WordPress plugin Admin Menu Editor (versions ≤ 1.0.4). The vulnerability is a Reflected Cross-Site Scripting caused by insufficient sanitization/escaping of a parameter before output on an admin page. Impact is a reflected XSS vector in the admin interface. Re...
Reflected Cross site scripting
Description When a user add new product with a supplier, supplier reference field is responsible to rxss Proof of Concept 1. Navigate to http://localhost/invoices/EditProducto?code=1&action=save-ok and goto supplier tab 2. Click on Add and in "Supplier reference" field add hey...
CVE-2022-1171: Improper Neutralization of Input During Web Page Generation
The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...
StaffList < 3.1.7 - Reflected Cross-Site Scripting
The plugin does to sanitise and escape a parameter before outputting it back in various places in an admin page, leading to a Reflected cross-Site Scripting v v 3.1.7 - https://example.com/wp-admin/admin.php?page=stafflist&search=aa' style=animation-name:rotation onanimationstart=alert/XSS///...
CVE-2022-0625: Improper Neutralization of Input During Web Page Generation
The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...
NewStart CGSL CORE 5.05 / MAIN 5.05 : pki-core Multiple Vulnerabilities (NS-SA-2022-0029)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pki-core packages installed that are affected by multiple vulnerabilities: - A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not...
StaffList < 3.1.7 - Reflected Cross-Site Scripting
The plugin does to sanitise and escape a parameter before outputting it back in various places in an admin page, leading to a Reflected cross-Site Scripting PoC v v 3.1.7 - https://example.com/wp-admin/admin.php?page=stafflist=aa' style=animation-name:rotation onanimationstart=alert/XSS///...
CVE-2022-29421 WordPress Countdown & Clock plugin <= 2.3.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycdtype vulnerable parameter...
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware vulnerability due to incomplete fix for CVE-2013-7370 Overview Connect is a stack of middleware that is executed in order in each request. The "methodOverride" middleware allows the http post to override the meth...
CVE-2022-28081
A reflected cross-site scripting XSS vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web scripts...
CVE-2022-29424
Authenticated admin or higher user role Reflected Cross-Site Scripting XSS vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin = 9.7.1 at WordPress...
Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting
The plugin does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious...
StaffList < 3.1.6 - Reflected Cross-Site Scripting
The plugin does to sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=stafflist=1=1%27%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E...
Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting
The plugin does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious...
WordPress Smush plugin <= 3.9.8 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Taurus Omar in WordPress Smush plugin versions = 3.9.8. Solution Update the WordPress Smush plugin to the latest available version at least 3.9.9...