CVE-2026-5231

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmsource' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utmsource value into the...

CVE-2025-13072 HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source

The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Starbucks: www.starbucks.co.uk Reflected XSS via utm_source parameter

https://www.starbucks.co.uk/shop/card/egift?utmcampaign=egift&utmcontent=WinterFY16&utmmedium=GPH&utmsource=SBUXcouk"%3e%3cb%20onbeforescriptexecute=promptdocument.domain%3e Payload: "%3e%3cb%20onbeforescriptexecute=promptdocument.domain%3e...