Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 1.9 Low
Mitel MiVoice Office 400 stored Cross-Site Scripting
- Mitel MiVoice Office 400
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability
- bPlugins B Blocks
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability
- WP Chill Image Photo Gallery Final Tiles Grid
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting
- code-projects Human Resource Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Human Resource Management Event Creation EventStore.php cross site scripting
- code-projects Human Resource Management
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.
- Cross-site scripting (XSS)
- CVSS 8.5 High
Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
- klembot twinejs
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
- yeswiki
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability
- Cozmoslabs TranslatePress
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability
- VeronaLabs WP Statistics
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability
- Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
- Simple Shopping Cart
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field
- Horizontal scrolling announcements
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting
- Omega Solution CoinEx Crypto
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments
- vincent-peugnet wcms
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
- OpenIdentityPlatform OpenAM
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
- OpenIdentityPlatform OpenAM
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
- zayedbaloch Twenty20 Image Before-After
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter
- wpclever WPC Estimated Delivery Date for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
- wardee Mail logging & Catcher
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
- syammohanm WPFront Notification Bar
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- cyberchimps Responsive Starter Templates – Elementor Templates & Starter Sites
- Cross-site scripting (XSS)
- CVSS 7.2 High
WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
- wpclever WPC Product Options for WooCommerce
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
- amauric WPMobile.App – Android and iOS App Builder
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration
- Loco Translate
- Cross-site scripting (XSS)
- CVSS 8.8 High
Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content
- Kubio AI Page Builder
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute
- Kubio AI Page Builder
- Cross-site scripting (XSS)
- CVSS 3.5 Low
WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload
- WP Ultimate CSV Importer
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
- WP Ultimate Review
- Cross-site scripting (XSS)
- CVSS 7.5 High
WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission
- WP Ultimate Review
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
- wpclever WPC Smart Quick View for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
- codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
- Cross-site scripting (XSS)
- CVSS 7.2 High
Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
- ivijanstefan Transliterator – Multilingual and Multi-script Text Conversion
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
- widgetpack Rich Showcase for Google Reviews
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter
- rainbowgeek SEOPress – AI SEO Plugin & On-site SEO
- Cross-site scripting (XSS)
- CVSS 7.2 High
Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget
- ultrapressorg Ultra Addons Lite for Elementor
- Cross-site scripting (XSS)
- CVSS 7.2 High
Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
- magicplugins Magic Tooltips For Contact Form 7
- Cross-site scripting (XSS)
- CVSS 7.2 High
SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name
- rainbowgeek SEOPress – AI SEO Plugin & On-site SEO
- Cross-site scripting (XSS)
- CVSS 7.2 High
Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
- wpchill Strong Testimonials
- Cross-site scripting (XSS)
- CVSS 7.2 High
GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX
- gdragon GD Rating System
- Cross-site scripting (XSS)
- CVSS 7.2 High
Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header
- wp-buy Visitor Traffic Real Time Statistics
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
- roxnor Wp Social Login and Register Social Counter
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute
- wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
- thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key
- nosilver4u EWWW Image Optimizer
- Cross-site scripting (XSS)
- CVSS 7.2 High
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment
- devowl Real Cookie Banner: GDPR & ePrivacy Cookie Consent
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
- properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
- vinod-dalvi Ivory Search – WordPress Search Plugin
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
- psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment
- jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
- ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Shopclass before 6.2.0 Stored XSS via Listing Description Field
- mindstellar shopclass
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Showdown through 2.1.0 XSS via unescaped quote in href and src attributes
- showdown
- Cross-site scripting (XSS)