Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.4 Medium
Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
- codesupplyco Powerkit – Supercharge your WordPress Site
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting
- SourceCodester Simple Traffic Offense System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting
- SourceCodester Syllabus-Aligned Learning Management & Examination System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
sfturing ssm_pro Order Endpoint OrderController.java cross site scripting
- sfturing ssm_pro
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
FastAdmin User Controller User.php login cross site scripting
- FastAdmin
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
projectworlds Online Examination System Feedback Form feedback.php cross site scripting
- projectworlds Online Examination System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Projectwolds Online Attendance System profile.php cross site scripting
- Projectwolds Online Attendance System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting
- code-projects Hotel and Tourism Reservation in PHP
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting
- code-projects Task Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.5 High
Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
- Kirki
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings
- Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
- sc0ttkclark Pods – Custom Content Types and Fields
- Cross-site scripting (XSS)
- CVSS 7.2 High
Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header
- supsysticcom Contact Form by Supsystic
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
- fooplugins Gallery : FooGallery
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter
- unitecms Unlimited Elements For Elementor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
- Elegant Themes Divi
- Cross-site scripting (XSS)
- CVSS 7.2 High
QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters
- Themovation QuickCal
- Cross-site scripting (XSS)
- CVSS 7.2 High
SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
- brainstormforce SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
- Cross-site scripting (XSS)
- CVSS 7.2 High
W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
- CVSS 7.2 High
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
- kstover Ninja Forms – The Contact Form Builder That Grows With You
- Cross-site scripting (XSS)
- CVSS 7.2 High
Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder
- Spam protection, Honeypot, Anti-Spam by CleanTalk
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter
- The Beaver Builder Team Beaver Builder Plugin (Starter Version)
- Cross-site scripting (XSS)
- CVSS 8.0 High
HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings
- HT Menu
- Cross-site scripting (XSS)
- CVSS 8.0 High
JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override
- JCH Optimize
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute
- Joli Table Of Contents
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute
- CatFolders Document Gallery & PDF Library
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
- VikWidgetsLoader
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
- King Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes
- Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL
- Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute
- Greenshift
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields
- Masteriyo LMS
- Cross-site scripting (XSS)
- CVSS 7.1 High
IPGP Visitors Origin < 1.6 - Reflected XSS
- IPGP Visitors Origin
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails
- JetFormBuilder — Dynamic Blocks Form Builder
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS
- Joli Table Of Contents
- Cross-site scripting (XSS)
- CVSS 7.2 High
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box
- quadlayers Social Chat – Click To Chat App Button
- Cross-site scripting (XSS)
- CVSS 7.2 High
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
- dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
- dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Emlog: Stored XSS via Tag Name in Article Editor
- emlog
- Cross-site scripting (XSS)
- CVSS 8.7 High
Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized
- emlog
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Possible XSS in the SNS web administration panel
- Stormshield Network Security
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust
- IBM Langflow OSS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System
- Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System
- Gastromenum Ticket and QR Menu System
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System
- Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Stored XSS in Menulux Software's Menulux Portal
- Menulux Software Inc. Menulux Portal
- Cross-site scripting (XSS)
- CVSS 8.4 High
OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy
- openpanel
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
- grav
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Grav Admin before 2.0.21 Stored XSS via username
- getgrav grav-plugin-admin2
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters
- getgrav grav-plugin-shortcode-core
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages
- grav
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
- thorsten phpMyFAQ
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
AVideo userLogin.php Reflected XSS via error parameter
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Interinfo｜DreamMaker - Reflected Cross-site Scripting
- Interinfo DreamMaker
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability
- Xtemos WoodMart
- Cross-site scripting (XSS)