WordPress Cooked Cross-Site Scripting Vulnerability

WordPress Cooked 1.16.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the cooked-timer short-code content. It may allow authenticated attackers with privileges of contributor or higher to inject...

WordPress Opti-Behavior Cross-Site Script Vulnerability

WordPress Opti-Behavior 1.9.2.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'countryname' Location parameter input and inadequate escaping of output data. Unauthenticated attackers can inject arbitrary web scripts,...

WordPress Ultra Addons for Contact Form 7: Cross-site Scripting Vulnerabilities

WordPress Ultra Addons for Contact Form 7 3.5.54 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping. Unauthenticated attackers can bypass the extension name blacklist by uploading text files with HTML...

Kitae Park Mang Board Cross-site Scripting Vulnerability

Kitae Park Mang Board 2.4.3 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'content' parameter, allowing for storage-type cross-site scripting attacks. Unauthenticated attackers can inject...

WordPress WebberZone Top 10 – Popular Posts: Cross-Site Script Vulnerabilities

WordPress WebberZone Top 10 – Popular Posts 4.5.2 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping, as well as parsing injections of the otherattributes parameter into instanceid and the undeclared iswidg...

WordPress RSS Aggregator by Feedzy: Cross-site Scripting Vulnerability

The WordPress RSS Aggregator by Feedzy version 5.2.11 and earlier has a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the “media:thumbnail@url” parameter, making it susceptible to stored-cross-site scripting attacks...

Complianz GDPR/CCPA Cookie Consent Banner Cross-site Script Vulnerability

The Complianz GDPR/CCPA Cookie Consent Banner versions 7.5.5 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. It involves stored cross-site scripting, enabled by the yotu-wp Cookie-Blocker filter. Unverifi...

WordPress Salon Booking System Cross-Site Script Vulnerability

The WordPress Salon Booking System versions 10.31.9 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the sln parameter. It may lead to storage-based cross-site scripting attacks. Unverified attackers can injec...

Johndarrel Hide My WP Ghost – Security & Firewall Cross-Site Script Vulnerabilities

Johndarrel Hide My WP Ghost – Security & Firewall 7.0.12 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping in the replaceHeadersAndTags function. It makes the system vulnerable to stored-cross-site scripti...

WordPress Opti-Behavior Cross-Site Script Vulnerability

WordPress Opti-Behavior 1.9.2.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'targetUrl' parameter input and inadequate escaping of output, resulting in a storage-type DOM-based cross-site script. Unauthenticated...

WPEVEREST User Registration PRO – Cross-site Scripting Vulnerability

The WPEVEREST User Registration PRO 6.2.9 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping. It can be exploited through the HTTP Referer header, leading to storage-type cross-site scripting attacks. This...

WordPress PowerPack Addons for Elementor: Cross-site Script Vulnerabilities

WordPress PowerPack Addons for Elementor 3.1.0 and earlier versions contain a cross-site scripting vulnerability. This vulnerability arises from improper input during web page generation, and could lead to storage-based cross-site scripting attacks...

InstantASP InstantForum.NET security vulnerabilities

The InstantASP InstantForum.NET 4.1.4 version has a security vulnerability. This vulnerability stems from a susceptibility to reflection-based cross-site scripting attacks. Inputs that are not properly cleaned in the query string parameters are directly reflected into the HTML response without...

WordPress SQL Chart Builder has a cross-site scripting vulnerability

WordPress SQL Chart Builder 3.0.6 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with privileges of subscriber or higher to inject arbitrary web scripts. This...

WordPress NotificationX Cross-Site Script Vulnerability

WordPress NotificationX versions 3.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from stored-xss attacks via the ‘name’ parameter. Due to insufficient input sanitization and output escaping, unauthenticated attackers can inject arbitrary web scripts, which wi...

WordPress: “Simply Schedule Appointments” app has a cross-site scripting vulnerability

WordPress versions prior to 1.6.12.35 have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the status parameter. It results in a stored-cross-site scripting attack, allowing unauthenticated attackers to inject arbitrary web...

WordPress TranslatePress cross-site scripting vulnerability

WordPress TranslatePress 3.3.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of input for the comment parameter and inadequate escaping of output, resulting in stored cross-site scripting. This could allow unauthenticated...

WordPress Tutor LMS Cross-site Scripting Vulnerability

WordPress Tutor LMS versions 4.0.8 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input validation of the redirecturl parameter in the Topbar component’s return handler, making it susceptible to DOM-based cross-site scripting attacks...

Surecart cross-site scripting vulnerabilities

Surecart versions 4.9.4 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the comment parameter, which may lead to stored-cross-site scripting attacks. Unauthenticated attackers can inject arbitrary web scripts...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a hosts group using the configuration with XSS payload, which will be available to other users. When XSS is stored by an authenticated malicious actor, and other users attempt to search for groups during the creation of new hosts, the XSS payload will activate,...