PT-2025-22741 · Unknown · Ctltwp Section Widget

Name of the Vulnerable Software and Affected Versions: ctltwp Section Widget versions n/a through 3.3.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS in the ctltwp Section Widget...

PT-2025-22783 · Fullworks · Fullworks Quick Contact Form

Name of the Vulnerable Software and Affected Versions: fullworks Quick Contact Form versions n/a through 8.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables potential...

PT-2025-22745 · Unknown · B2I Investor Tools

Name of the Vulnerable Software and Affected Versions: B2i Investor Tools versions 1.0.7.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This type of issue occurs wh...

PT-2025-22761 · Unknown · Khaled User Meta

Name of the Vulnerable Software and Affected Versions: Khaled User Meta versions n/a through 3.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions n/a throug...

PT-2025-22726 · Unknown · Theme Blvd Sliders

Name of the Vulnerable Software and Affected Versions: Theme Blvd Sliders versions 1.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can...

PT-2025-22779 · Unknown · Xili-Tidy-Tags

Name of the Vulnerable Software and Affected Versions: xili-tidy-tags versions 1.12.06 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This type of issue occurs when...

PT-2025-22739 · Unknown · My Custom Widgets

Name of the Vulnerable Software and Affected Versions: My Custom Widgets versions n/a through 2.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2025-22709 · Goodlayers · Goodlayers Hostel

Name of the Vulnerable Software and Affected Versions: Goodlayers Hostel versions 3.1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For Goodlayers Hostel...

WordPress plugin EC Authorize.net 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-22737 · Unknown · M A Vinoth Kumar Category Widget

Name of the Vulnerable Software and Affected Versions: M A Vinoth Kumar Category Widget versions n/a through 2.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in the Category...

PT-2025-22720 · Unknown · Kstats Reloaded

Name of the Vulnerable Software and Affected Versions: kStats Reloaded versions 0.7.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to injec...

CVE-2022-41350

In Zimbra Collaboration Suite ZCS 8.8.15, /h/search?action=voicemail=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

CVE-2022-2116

The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting...

CVE-2022-2072

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...

CVE-2022-1756

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...

CVE-2022-1584

Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim...

CVE-2022-1288

A vulnerability, which was classified as problematic, has been found in School Club Application System 1.0. This issue affects access to /scas/admin/. The manipulation of the parameter page with the input %22%3E%3Cimg%20src=x%20onerror=alert1%3E leads to a reflected cross site scripting. The atta...

CVE-2022-1171

The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2022-1164

The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature...

CVE-2022-37044

In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine...