Cross site scripting

The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedifymsg parameter found in the /includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8...

Cross site scripting

The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the /wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

Cross site scripting

The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the /sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1...

Cross site scripting

The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2...

Cross site scripting

The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

Cross site scripting

The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-38357 SMS OVH <= 0.1 Reflected Cross-Site Scripting

The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the /sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1...

CVE-2021-38357 SMS OVH <= 0.1 Reflected Cross-Site Scripting

The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the /sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1...

CVE-2021-38357

CVE-2021-38357 affects the WordPress plugin SMS OVH (versions up to and including 0.1). The Reflected Cross‑Site Scripting vulnerability originates in the position parameter in the file ~/sms-ovh-sent.php, enabling injection of arbitrary web scripts. Connected sources consistently describe this i...

CVE-2021-38358 MoolaMojo <= 0.7.4.1 Reflected Cross-Site Scripting

The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the /views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1...

CVE-2021-38358

Summary: CVE-2021-38358 affects the MoolaMojo WordPress plugin up to version 0.7.4.1. It is a Reflected Cross-Site Scripting (XSS) vulnerability exposed via the classes parameter in ~/views/button-generator.html.php, allowing injection of arbitrary scripts. Impact: as per CVSSv3.1 metrics, base s...

CVE-2021-38358 MoolaMojo <= 0.7.4.1 Reflected Cross-Site Scripting

The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the /views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1...

CVE-2021-38359 WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site Scripting

The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the /admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1...

CVE-2021-38359 WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site Scripting

The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the /admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1...

CVE-2021-38354

The issue is a Reflected Cross-Site Scripting vulnerability in the WordPress plugin GNU-Mailman Integration (versions up to and including 1.0.6). The flaw is triggered via the gm_error parameter in the file path ~/includes/admin/mailing-lists-page.php , allowing an attacker to inject arbitrary we...

CVE-2021-38354 GNU-Mailman Integration <= 1.0.6 Reflected Cross-Site Scripting

The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gmerror parameter found in the /includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6...

CVE-2021-38327 YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting

The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0...

CVE-2021-38327 YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting

The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0...

CVE-2021-38339 Simple Matted Thumbnails <= 1.01 Reflected Cross-Site Scripting

The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.01...

CVE-2021-38339

The CVE-2021-38339 entry affects the WordPress plugin Simple Matted Thumbnails, version ≤ 1.01. The vulnerability is a Reflected Cross-Site Scripting flaw caused by a reflected value in $_SERVER["PHP_SELF"] within the simple-matted-thumbnail.php file, enabling an attacker to inject arbitrary web ...