Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability
- Happyforms
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability
- Morteza Geransayeh Parsi Date
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability
- KingAddons.com King Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability
- Nexcess GiveWP
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability
- POSIMYTH The Plus Addons for Elementor Page Builder Lite
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability
- awesomesupport Awesome Support
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability
- bobbingwide oik
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability
- vendidero Trusted Shops Easy Integration for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability
- WP Titan Labs WooCommerce Product Table Lite
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability
- pixfort Core
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability
- YITHEMES YITH WooCommerce Ajax Search
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability
- RadiusTheme Classified Listing
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability
- Cozmoslabs Profile Builder
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability
- SweetCode Pixel Manager for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- lukeseager WordPress Persistent Login
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability
- Gemini Labs Site Reviews
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
- 10up Safe SVG
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability
- VeronaLabs WP Statistics
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability
- rainafarai Notification for Telegram
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability
- ilGhera JW Player for WordPress
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability
- Leevio Happy Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability
- Qode Qi Addons For Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
- Leap13 Premium Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability
- WPFunnels
- Cross-site scripting (XSS)
- CVSS 2.7 Low
WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability
- Brainstorm Force Astra WordPress Theme
- Cross-site scripting (XSS)
- CVSS 8.3 High
MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
- MISP
- Cross-site scripting (XSS)
- CWE-20
- CVSS 4.3 Medium
Moodle: xss via password reset link due to insufficient username escaping
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Moodle: xss in forum post templates due to insufficient escaping
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting
- DigiWin EasyFlow .NET
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
- rockiger ReactPress – Create React App for WordPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- ahsangadit Viable URL Media Uploader
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter
- rameez_iqbal Real Estate Manager – Property Listing and Agent Management
- Cross-site scripting (XSS)
- CVSS 7.2 High
Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
- kazukiyanamoto Post Views Stats Counter
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
- boldthemes Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute
- boldthemes Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
- boldthemes Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
- nextendweb Smart Slider 3
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
- devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
- boldthemes Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
- boldthemes Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in baserCMS
- baserCMS
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in baserCMS
- baserCMS
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in baserCMS
- baserCMS
- Cross-site scripting (XSS)
- CVSS 8.8 High
Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API
- Verge3D Publishing and E-Commerce
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
- Content Egg
- Cross-site scripting (XSS)
- CVSS 7.1 High
WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
- WP Mobile Menu
- Cross-site scripting (XSS)
- CVSS 7.5 High
Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser
- Robin Image Optimizer
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute
- Hostinger Reach
- Cross-site scripting (XSS)
- CVSS 8.8 High
All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
- All in One Files Upload
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL
- Audio Player Block
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute
- EmbedPress
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields
- Schema & Structured Data for WP & AMP
- Cross-site scripting (XSS)
- CVSS 7.2 High
Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
- wpshuffle Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting
- gedelumbung HospitalManagement
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
Stored i18n XSSs in CentralNotice
- The Wikimedia Foundation Mediawiki - CentralNotice extension
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Stored i18n XSS in MassMessage
- The Wikimedia Foundation Mediawiki - MassMessage extension
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
XSS in Cargo's Special:CargoQuery page due to unsanitized table headers
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
XSS through i18n message in CentralAuth
- The Wikimedia Foundation Mediawiki - CentralAuth extension
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
XSS in Refreshed skin
- The Wikimedia Foundation Mediawiki - Refreshed skin
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML
- The Wikimedia Foundation Mediawiki - WikiLambda Extension
- Cross-site scripting (XSS)