CVE-2025-4223

The Page Builder: Pagelayer WordPress plugin (CVE-2025-4223) is vulnerable to Reflected XSS via the login_url parameter in versions up to 2.0.0 due to insufficient input sanitization and output escaping. Attacks require a user to click a crafted link and execute within that user’s context; no exp...

CVE-2025-31636

CVE-2025-31636 is a reflected Cross-Site Scripting vulnerability in the WordPress plugin “WP Post Modules for Elementor.” Affected versions are up to and including 2.5.0. The issue arises from improper input neutralization during web page generation. Evidence from multiple sources confirms the vu...

CVE-2025-39505

CVE-2025-39505 refers to a Reflected Cross-Site Scripting (XSS) in the WordPress plugin Goodlayers Hotel (versions up to and including 3.1.4). Technical details in connected sources confirm the vulnerability is an input neutralization flaw during web page generation that enables reflected XSS. Th...

CVE-2025-46440

CVE-2025-46440 is a Reflected Cross-Site Scripting vulnerability in WordPress kStats Reloaded (versions <= 0.7.4). The issue is caused by improper input neutralization during web page generation, enabling reflected XSS. Public sources (NVD/Red Hat entries) describe the vulnerability and affect...

CVE-2024-48534

A reflected cross-site scripting XSS vulnerability on the Camp Details module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2024-55239

A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulodocumento' parameter...

CVE-2023-30469

Cross-site Scripting vulnerability in Hitachi Ops Center Analyzer Hitachi Ops Center Analyzer detail view component allows Reflected XSS.This issue affects Hitachi Ops Center Analyzer: from 10.9.1-00 before 10.9.2-00...

CVE-2023-32106

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Fahad Mahmood WP Docs plugin = 1.9.9 versions...

CVE-2023-32105

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ollybach WPPizza – A Restaurant Plugin plugin = 3.17.1 versions...

CVE-2023-22984

A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL...

CVE-2023-0676

Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1...

CVE-2023-0300

Cross-site Scripting XSS - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301...

CVE-2023-0448

The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability...

CVE-2023-50893

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UpSolution Impreza – WordPress Website and WooCommerce Builder allows Reflected XSS.This issue affects Impreza – WordPress Website and WooCommerce Builder: from n/a through 8.17.4...

CVE-2023-23161

A reflected cross-site scripting XSS vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar...

CVE-2023-1239

Cross-site Scripting XSS - Reflected in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-2321

The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as...

CVE-2023-2402

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchterm parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress plugin My Custom Widgets 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin Quick Contact Form 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...