CVE-2021-38321

The CVE-2021-38321 entry describes a Reflected Cross-Site Scripting vulnerability in the WordPress plugin “Custom Menu Plugin” (versions up to and including 1.3.3). The affected component is the plugin’s file ~/custom-menus.php, with the selected_menu parameter enabling injection of arbitrary scr...

CVE-2021-38321 Custom Menu Plugin <= 1.3.3 Reflected Cross-Site Scripting

The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selectedmenu parameter found in the /custom-menus.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.3...

CVE-2021-38320 simpleSAMLphp Authentication <= 0.7.0 Reflected Cross-Site Scripting

The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0...

CVE-2021-38320

CVE-2021-38320 concerns the WordPress plugin simpleSAMLphp Authentication (versions

CVE-2021-38316 WP Academic People List <= 0.4.1 Reflected Cross-Site Scripting

The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the categoryname parameter in the /admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1...

CVE-2021-38316 WP Academic People List <= 0.4.1 Reflected Cross-Site Scripting

The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the categoryname parameter in the /admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1...

CVE-2021-38316

The CVE-2021-38316 entry corresponds to a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WP Academic People List. Affected component: category_name parameter in admin-panel.php. Root cause: input reflected in the page without proper sanitization, allowing arbitrary scr...

CVE-2021-38322 Twitter Friends Widget <= 3.1 Reflected Cross-Site Scripting

The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1...

CVE-2021-38318

CVE-2021-38318 concerns the WordPress plugin “3D Cover Carousel” (versions ≤ 1.0). The vulnerability is a Reflected Cross-Site Scripting (XSS) via the id parameter in ~/cover-carousel.php, enabling injection of arbitrary scripts. Affected component is the plugin’s PHP code handling the id input; ...

WordPress WP-T-Wap plugin <= 1.13.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress WP-T-Wap plugin versions = 1.13.2. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

CVE-2021-38321: Improper Neutralization of Input During Web Page Generation

The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selectedmenu parameter found in the /custom-menus.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.3...

WordPress Woocommerce Payment Gateway per Category plugin <= 2.0.10 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Woocommerce Payment Gateway per Category plugin versions = 2.0.10. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Wise Agent Lead Capture Forms plugin <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Wise Agent Lead Capture Forms plugin versions = 1.0. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Edit Comments XT plugin <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Edit Comments XT plugin versions = 1.0. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Notices Ticker plugin <= 6.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Notices Ticker plugin versions = 6.1. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress RSVPmaker Excel plugin <= 1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress RSVPmaker Excel plugin versions = 1.1. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

3D Cover Carousel <= 1.0 - Reflected Cross-Site Scripting

Description The plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the /cover-carousel.php file which allows attackers to inject arbitrary web scripts...

MoolaMojo <= 0.7.4.1 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the /views/button-generator.html.php file which allows attackers to inject arbitrary web scripts...

Border Loading Bar <= 1.0.1 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the /titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts...

Notices <= 6.1 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /notices.php file which allows attackers to inject arbitrary web scripts...