Cross-site scripting (XSS).

WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

• Shamim Hasan Front End PM
• Cross-site scripting (XSS)

WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

• nicdark Hotel Booking
• Cross-site scripting (XSS)

WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

• Dan Rossiter Document Gallery
• Cross-site scripting (XSS)

WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

• Youzify
• Cross-site scripting (XSS)

WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

• themeansar Ansar Import – One Click Starter Sites – for Elementor &amp; Themes
• Cross-site scripting (XSS)

WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

• reputeinfosystems ARForms
• Cross-site scripting (XSS)

WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability

• Midtrans-WooCommerce
• Cross-site scripting (XSS)

WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

• weDevs StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart
• Cross-site scripting (XSS)

WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

• ThemeMove EduMall
• Cross-site scripting (XSS)

WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

• bestweblayout Contact Form to DB by BestWebSoft
• Cross-site scripting (XSS)

WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

• code4life Database for CF7
• Cross-site scripting (XSS)

WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

• Saravana Kumar K WC Fields Factory
• Cross-site scripting (XSS)

WordPress Lumise Product Designer plugin < 2.1.4.1 - Cross Site Scripting (XSS) vulnerability

• Lumise Product Designer
• Cross-site scripting (XSS)

WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

• veppa HTTP Requests Manager
• Cross-site scripting (XSS)

WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

• VibeThemes WPLMS
• Cross-site scripting (XSS)

WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

• Mapster WP Maps
• Cross-site scripting (XSS)

WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability

• N-Media Frontend File Manager
• Cross-site scripting (XSS)

WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

• Fantastic Plugins SUMO Affiliates Pro
• Cross-site scripting (XSS)

WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

• EDGARROJAS Smart Forms
• Cross-site scripting (XSS)

WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

• weDevs WP User Frontend Pro
• Cross-site scripting (XSS)

WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

• Colabrio Ohio Extra
• Cross-site scripting (XSS)

WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

• DaftPlug Progressify - Progressive Web App (PWA)
• Cross-site scripting (XSS)

WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

• Joomunited WP Media folder
• Cross-site scripting (XSS)

SourceCodester Simple Student Information System Profile Field register.php cross site scripting

• SourceCodester Simple Student Information System
• Cross-site scripting (XSS)
• Code injection

WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability

• Crocoblock JetElements For Elementor
• Cross-site scripting (XSS)

SourceCodester Simple Student Information System searchresults.php clean cross site scripting

• SourceCodester Simple Student Information System
• Cross-site scripting (XSS)
• Code injection

WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

• Tomlister Payflex Payment Gateway
• Cross-site scripting (XSS)

Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

• saadiqbal Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
• Cross-site scripting (XSS)

imgproxy SVG svg.go sanitizeElement cross site scripting

• imgproxy
• Cross-site scripting (XSS)
• Code injection

WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability

• Creative interactive media Real 3D FlipBook
• Cross-site scripting (XSS)

SourceCodester Drug Recommendation System add_drug.php cross site scripting

• SourceCodester Drug Recommendation System
• Cross-site scripting (XSS)
• Code injection

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

• Cross-site scripting (XSS)

<3.4.16 · fixed in 3.4.16

Joplin whiteboard card rendering allows CSS injection into application chrome

• laurent22 joplin
• Cross-site scripting (XSS)

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

• Cross-site scripting (XSS)
• CWE-116

<3.5.42 || >=3.6.0-rc.0, <3.6.0-rc.6 · fixed in 3.5.42, 3.6.0-rc.6

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

• Cross-site scripting (XSS)

<1.42.3 · fixed in 1.42.3

Penpot: Stored XSS via Unsanitised SVG Uploads

• penpot
• Cross-site scripting (XSS)

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability

• VillaTheme Photo Reviews for WooCommerce
• Cross-site scripting (XSS)

WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability

• Webful Creations RepairBuddy
• Cross-site scripting (XSS)

Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

• plane
• Cross-site scripting (XSS)
• Unrestricted file upload

Plane: Cross-tenant stored XSS in intake enables account takeover

• plane
• Cross-site scripting (XSS)
• Broken access control

WordPress Adsmonetizer plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability

• Jose Fernandez Adsmonetizer
• Cross-site scripting (XSS)

WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability

• GhozyLab Image Slider Widget
• Cross-site scripting (XSS)

Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

• Red Hat Quay 3
• Cross-site scripting (XSS)

Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

• Red Hat Quay 3
• Cross-site scripting (XSS)

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2

• joomshaper.com SP Page Builder (Pro) extension for Joomla
• Cross-site scripting (XSS)

LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

• ThimPress LearnPress
• Cross-site scripting (XSS)

feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting

• feelec-yishu feelcrm-os
• Cross-site scripting (XSS)
• Code injection

Stored XSS vulnerability in OAuth configuration form

• Zabbix
• Cross-site scripting (XSS)

feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

• feelec-yishu feelcrm-os
• Cross-site scripting (XSS)
• Code injection

feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting

• feelec-yishu feelcrm-os
• Cross-site scripting (XSS)
• Code injection

WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability

• Brainstorm Force Starter Templates
• Cross-site scripting (XSS)

WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability

• Jeroen Peters Name Directory
• Cross-site scripting (XSS)

WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability

• Brainstorm Force Presto Player
• Cross-site scripting (XSS)

WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability

• LeapWorx Premium Addons for Elementor
• Cross-site scripting (XSS)

WordPress Logo Showcase plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

• Themepoints Logo Showcase
• Cross-site scripting (XSS)

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability

• MP3 Audio Player for Music, Radio & Podcast by Sonaar
• Cross-site scripting (XSS)

WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

• impleCode eCommerce Product Catalog
• Cross-site scripting (XSS)

WordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

• Nikki Blight QR Redirector
• Cross-site scripting (XSS)

WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

• Liquid Web / StellarWP GiveWP
• Cross-site scripting (XSS)

Mitel MiVoice Office 400 stored Cross-Site Scripting

• Mitel MiVoice Office 400
• Cross-site scripting (XSS)