CVE-2021-38331

Affected software: WordPress WP-T-Wap plugin (up to version 1.13.2). Vulnerability: Reflected Cross-Site Scripting via a posted parameter in the file ~/wap/writer.php, allowing injection of arbitrary web scripts. Impact: Noted as arbitrary script execution via reflected XSS; no further impact det...

CVE-2021-38331 WP-T-Wap <= 1.13.2 Reflected Cross-Site Scripting

The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the /wap/writer.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.13.2...

CVE-2021-38333 WP Scrippets <= 1.5.1 Reflected Cross-Site Scripting

The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /wp-scrippets.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.1...

CVE-2021-38333

The CVE-2021-38333 entry refers to the WP Scrippets WordPress plugin. A Reflected Cross-Site Scripting (XSS) vulnerability exists due to a reflected $_SERVER["PHP_SELF"] value in ~/wp-scrippets.php, enabling injection of arbitrary web scripts. Affected versions are up to and including 1.5.1. CVSS...

CVE-2021-38352 Feedify – Web Push Notifications <= 2.1.8 Reflected Cross-Site Scripting

The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedifymsg parameter found in the /includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8...

CVE-2021-38341 WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting

The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /includes/pluginsettings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10...

CVE-2021-38340

The WordPress Simple Shop plugin for WordPress (versions up to 1.2) is vulnerable to Reflected Cross-Site Scripting via the update_row parameter in the file ~/includes/add_product.php, allowing attackers to inject arbitrary scripts. Multiple connected documents corroborate this, stating the vulne...

CVE-2021-38340 Wordpress Simple Shop <= 1.2 Reflected Cross-Site Scripting

The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the updaterow parameter found in the /includes/addproduct.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-38349

The CVE-2021-38349 entry documents a Reflected Cross-Site Scripting vulnerability in the WordPress plugin “Integration of Moneybird for WooCommerce” prior to or including version 2.1.1. The issue stems from the error_description parameter in the file templates/wcmb-admin.php, enabling injection o...

CVE-2021-38353

The CVE relates to the WordPress plugin “Dropdown and scrollable Text” (≤ 2.0). The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the content parameter of the ~/index.php file, allowing attackers to inject arbitrary web scripts. Affected versions are up to 2.0; the root cause is...

CVE-2021-38353 Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...

CVE-2021-38326 Post Title Counter <= 1.1 Reflected Cross-Site Scripting

The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the /post-title-counter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1...

CVE-2021-38326

CVE-2021-38326 concerns the WordPress Post Title Counter plugin. According to the provided sources, the vulnerability is a Reflected Cross-Site Scripting (XSS) flaw via the notice parameter in the ~/post-title-counter.php file, affecting versions up to and including 1.1. The core issue is lack of...

CVE-2021-38348 Advance Search <= 1.1.2 Reflected Cross-Site Scripting

The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpasid parameter found in the /inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.2...

CVE-2021-38348

The CVE-2021-38348 entry describes a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress Advanced Search plugin (versions up to and including 1.1.2) due to the wpas_id parameter in the file ~/inc/admin/views/html-advance-search-admin-options.php. The underlying issue is a reflecte...

CVE-2021-38332 On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site Scripting

The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

CVE-2021-38332

The CVE relates to the WordPress plugin “On Page SEO + Whatsapp Chat Button” (versions up to 1.0.1) which is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in settings.php. The underlying flaw enables attackers to inject arbitrary scripts in contexts wh...

CVE-2021-38332 On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site Scripting

The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...

CVE-2021-38337 RSVPMaker Excel <= 1.1 Reflected Cross-Site Scripting

The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1...

CVE-2021-38330

The CVE-2021-38330 entry concerns the Yet Another bol.com WordPress plugin. Multiple connected sources confirm a Reflected Cross-Site Scripting (XSS) vulnerability caused by a reflected $_SERVER["PHP_SELF"] value in yabp.php, affecting versions up to and including 1.4. Impact described as the abi...