CVE-2021-38357: Improper Neutralization of Input During Web Page Generation

The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the /sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1...

CVE-2021-38350: Improper Neutralization of Input During Web Page Generation

The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the /analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1...

CVE-2020-19283

A reflected cross-site scripting XSS vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...

CVE-2020-19282

A reflected cross-site scripting XSS vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field...

CVE-2020-19283

A reflected cross-site scripting XSS vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...

EUVD-2020-11200

A reflected cross-site scripting XSS vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...

CVE-2020-19283

A reflected cross-site scripting XSS vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...

CVE-2021-38325

The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0...

CVE-2021-38320

The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0...

CVE-2021-38322

The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1...

CVE-2021-38316

The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the categoryname parameter in the /admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1...

Cross site scripting

The 3D Cover Carousel WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the /cover-carousel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-38323 RentPress <= 6.6.4 Reflected Cross-Site Scripting

The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the /src/rentPress/AjaxRequests.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.6.4...

CVE-2021-38323

The RentPress WordPress plugin is affected by a Reflected Cross-Site Scripting (XSS) vulnerability via the selections parameter in the AjaxRequests.php file, impacting versions up to and including 6.6.4. The issue allows injection of arbitrary web scripts. Exploitation status is not stated in the...

CVE-2021-38325 User Activation Email <= 1.3.0 Reflected Cross-Site Scripting

The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the /user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0...

CVE-2021-38325

CVE-2021-38325 affects the WordPress plugin User Activation Email (versions

CVE-2021-38319

CVE-2021-38319 affects the WordPress plugin More From Google (versions up to 0.0.2). The vulnerability is a Reflected XSS caused by a reflected $_SERVER["PHP_SELF"] in the file ~/morefromgoogle.php, enabling injection of arbitrary scripts. The connected sources confirm the affected component and ...

CVE-2021-38317 Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site Scripting

The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the planid parameter in the /views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.8.3...

CVE-2021-38317

The CVE-2021-38317 issue affects the WordPress plugin Konnichiwa! Membership (versions

CVE-2021-38321

The CVE-2021-38321 entry describes a Reflected Cross-Site Scripting vulnerability in the WordPress plugin “Custom Menu Plugin” (versions up to and including 1.3.3). The affected component is the plugin’s file ~/custom-menus.php, with the selected_menu parameter enabling injection of arbitrary scr...