Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0
- regularlabs.com Snippets (Free) extension for Joomla
- regularlabs.com Snippets (Pro) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5
- regularlabs.com Quick Index (Free, Pro) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0
- regularlabs.com Modals (Free, Pro) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0
- regularlabs.com Articles Anywhere (Free, Pro) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0
- regularlabs.com Modals (Pro) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0
- regularlabs.com Tabs & Accordions (Free, Pro) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System subject1.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
Cross-site scripting in MediaWiki MassMessage
- MediaWiki MassMessage
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site scripting in Frappe
- Frappe
- Cross-site scripting (XSS)
- CVSS 7.2 High
Cross-site scripting in Paessler PRTG Network Monitor
- Paessler PRTG Network Monitor
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Totolink A3002MU Anchor Tag cross site scripting
- Totolink A3002MU
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting
- Anil-matcha Open-Generative-AI
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server
- YouTube Embed
- Cross-site scripting (XSS)
- CVSS 8.8 High
Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import
- Hoo Companion
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
kagisearch smallweb Query String Rendering sw.py index cross site scripting
- kagisearch smallweb
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Exrick xmall Order Printing order-print.jsp cross site scripting
- Exrick xmall
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting
- linlinjava litemall
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting
- linlinjava litemall
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting
- moxi624 Mogu Blog v2
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting
- quequnlong shiyi-blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting
- quequnlong shiyi-blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting
- maliangnansheng bbs-springboot
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting
- DataEase
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
TDuckApp tduck-platform Form Write View index.vue cross site scripting
- TDuckApp tduck-platform
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
quequnlong shiyi-blog Add Message API index.vue cross site scripting
- quequnlong shiyi-blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.3 High
Amundsen Frontend through 4.3.0 Stored XSS via Description
- amundsen-io amundsen-frontend
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
- strapi
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
stilleshan ServerStatus Stats Generation main.cpp cross site scripting
- stilleshan ServerStatus
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting
- Fengoffice Feng Office
- Cross-site scripting (XSS)
- Code injection
- CVSS 1.8 Low
Cross-site scripting in Grav
- Grav
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site scripting in Repetico web backend
- Repetico web backend
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Xuxueli xxl-job insert cross site scripting
- Xuxueli xxl-job
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.4 Medium
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
- melograno Booking for Appointments and Events Calendar – Amelia
- Cross-site scripting (XSS)
- CVSS 8.0 High
YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
- YayPricing
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode
- WP Highlight Box
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights
- Masteriyo LMS
- Cross-site scripting (XSS)
- CVSS 8.8 High
BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation
- BE REST Endpoints
- Cross-site scripting (XSS)
- CVSS 7.1 High
Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF
- Export & Import WPBakery Page Builder
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes
- Custom Menu Wizard Widget
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
QloApps through 1.7.0 Reflected XSS via List Filter Parameters
- Webkul QloApps
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Cross-site Scripting in Malcolm
- CISA Malcolm
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)
- smgdkngt dobase
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability
- Visual Composer Website Builder
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
- Ido Kobelkowsky Simple Payment
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability
- boldthemes Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected XSS in IdeaSoft's Smart E-Commerce
- IdeaSoft Software Industry and Trade Inc. Smart E-Commerce
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo Bookmark Plugin Stored XSS via Chapter Names
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo LoginControl Stored XSS via PGP Public Key
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo CustomizeUser Stored XSS via field_name Parameter
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo Stored XSS via donationLink in watch page button
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo YPTWallet Stored XSS via CryptoWallet Configuration
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WWBN AVideo Reflected XSS via Gallery Category getBackURL
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.2 CriticalCritical · CVSS 9+
WWBN AVideo Stored XSS via UserGroups setGroup_name
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WWBN AVideo Reflected XSS via confirmLivePassword.php
- WWBN AVideo
- Cross-site scripting (XSS)