WordPress Premium Packages Cross-Site Script Vulnerabilities

WordPress Premium Packages 7.2.8 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'note' parameter input and inadequate escaping of output data. It results in a storage-type cross-site script attack. Attackers with...

WordPress Flying Scripts Cross-Site Script Vulnerabilities

WordPress Flying Scripts 1.2.4 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. It allows for storage-type cross-site scripting attacks, enabling unverified attackers to inject any web script into th...

Kitae Park Mang Board Cross-site Scripting Vulnerability

Kitae Park Mang Board 2.4.3 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'content' parameter, allowing for storage-type cross-site scripting attacks. Unauthenticated attackers can inject...

WordPress WebberZone Top 10 – Popular Posts: Cross-Site Script Vulnerabilities

WordPress WebberZone Top 10 – Popular Posts 4.5.2 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping, as well as parsing injections of the otherattributes parameter into instanceid and the undeclared iswidg...

WordPress RSS Aggregator by Feedzy: Cross-site Scripting Vulnerability

The WordPress RSS Aggregator by Feedzy version 5.2.11 and earlier has a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the “media:thumbnail@url” parameter, making it susceptible to stored-cross-site scripting attacks...

Complianz GDPR/CCPA Cookie Consent Banner Cross-site Script Vulnerability

The Complianz GDPR/CCPA Cookie Consent Banner versions 7.5.5 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. It involves stored cross-site scripting, enabled by the yotu-wp Cookie-Blocker filter. Unverifi...

WordPress Salon Booking System Cross-Site Script Vulnerability

The WordPress Salon Booking System versions 10.31.9 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the sln parameter. It may lead to storage-based cross-site scripting attacks. Unverified attackers can injec...

WordPress Opti-Behavior Cross-Site Script Vulnerability

WordPress Opti-Behavior 1.9.2.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'targetUrl' parameter input and inadequate escaping of output, resulting in a storage-type DOM-based cross-site script. Unauthenticated...

WordPress PowerPack Addons for Elementor: Cross-site Script Vulnerabilities

WordPress PowerPack Addons for Elementor 3.1.0 and earlier versions contain a cross-site scripting vulnerability. This vulnerability arises from improper input during web page generation, and could lead to storage-based cross-site scripting attacks...

HivePress cross-site scripting vulnerability

HivePress versions 1.7.32 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of input parameters such as '' e.g., hpcustomlink' and inadequate escaping of output data. As a result, stored cross-site scripts allow unauthenticated attackers to...

WordPress Ultra Addons for Contact Form 7: Cross-site Scripting Vulnerabilities

WordPress Ultra Addons for Contact Form 7 3.5.54 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping. Unauthenticated attackers can bypass the extension name blacklist by uploading text files with HTML...

Surecart cross-site scripting vulnerabilities

Surecart versions 4.9.4 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the comment parameter, which may lead to stored-cross-site scripting attacks. Unauthenticated attackers can inject arbitrary web scripts...

WPEVEREST User Registration PRO – Cross-site Scripting Vulnerability

The WPEVEREST User Registration PRO 6.2.9 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping. It can be exploited through the HTTP Referer header, leading to storage-type cross-site scripting attacks. This...

WordPress Cooked Cross-Site Scripting Vulnerability

WordPress Cooked 1.16.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the cooked-timer short-code content. It may allow authenticated attackers with privileges of contributor or higher to inject...

Checkmk Input Validation Vulnerability

Versions of Checkmk prior to 2.5.0p15, 2.4.0p38, 2.3.0p51, and 2.2.0 contain a vulnerability related to input validation errors. This vulnerability stems from improper validation of the reseturl parameter during the Setup page. It may allow attackers to trick users into opening a specially crafte...

Nexcess The Events Calendar: Cross-site Scripting Vulnerability

Nexcess The Events Calendar versions 6.18.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and could lead to storage-based cross-site scripting attacks...

InstantASP InstantForum.NET security vulnerabilities

The InstantASP InstantForum.NET 4.1.4 version has a security vulnerability. This vulnerability stems from a susceptibility to reflection-based cross-site scripting attacks. Inputs that are not properly cleaned in the query string parameters are directly reflected into the HTML response without...

WordPress: “Simply Schedule Appointments” app has a cross-site scripting vulnerability

WordPress versions prior to 1.6.12.35 have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the status parameter. It results in a stored-cross-site scripting attack, allowing unauthenticated attackers to inject arbitrary web...

Johndarrel Hide My WP Ghost – Security & Firewall Cross-Site Script Vulnerabilities

Johndarrel Hide My WP Ghost – Security & Firewall 7.0.12 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping in the replaceHeadersAndTags function. It makes the system vulnerable to stored-cross-site scripti...

WordPress NotificationX Cross-Site Script Vulnerability

WordPress NotificationX versions 3.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from stored-xss attacks via the ‘name’ parameter. Due to insufficient input sanitization and output escaping, unauthenticated attackers can inject arbitrary web scripts, which wi...