Cross-site scripting (XSS).

LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter

• hippooo Hippoo Mobile App for WooCommerce
• Cross-site scripting (XSS)

tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

• AmauriC tarteaucitron.js
• Cross-site scripting (XSS)

countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

• countly-server
• Cross-site scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

• Arcadia Technology, LLC Crafty Controller
• Cross-site scripting (XSS)

Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role

• themefic Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
• Cross-site scripting (XSS)

WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

• IdeaBox Creations PowerPack Addons for Elementor
• Cross-site scripting (XSS)

WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability

• Liquid Web / StellarWP The Events Calendar
• Cross-site scripting (XSS)

WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability

• PT Norther Lights Production MapSVG
• Cross-site scripting (XSS)

WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter

• switcorp WP Sessions Time Monitoring Full Automatic
• Cross-site scripting (XSS)

Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter

• liedekef Events Made Easy
• Cross-site scripting (XSS)

GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute

• paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
• Cross-site scripting (XSS)

GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body

• softaculous GoSMTP Pro
• Cross-site scripting (XSS)

Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute

• jeroenpeters1986 Name Directory
• Cross-site scripting (XSS)

SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment

• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
• Cross-site scripting (XSS)

Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter

• themeum Tutor LMS – eLearning and online course solution
• Cross-site scripting (XSS)

SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

• brainstormforce SureDash – Community, Courses & Member Dashboard
• Cross-site scripting (XSS)

Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting

• maxfoundry Social Share Buttons
• Cross-site scripting (XSS)

FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter

• damian-gora FiboSearch – Ajax Search for WooCommerce
• Cross-site scripting (XSS)

User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header

• WPEverest User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin
• Cross-site scripting (XSS)

WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

• Houzez
• Cross-site scripting (XSS)

WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)

• smub WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)
• Cross-site scripting (XSS)

WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import

• etruel WPeMatico RSS Feed Fetcher
• Cross-site scripting (XSS)

HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value

• HivePress – Business Directory, Listings & Classified Ads Plugin
• Cross-site scripting (XSS)

TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

• cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation
• Cross-site scripting (XSS)

HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode

• HivePress – Business Directory, Listings & Classified Ads Plugin
• Cross-site scripting (XSS)

WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute

• ajay WebberZone Top 10 — Popular Posts
• Cross-site scripting (XSS)

GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field

• paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
• Cross-site scripting (XSS)

Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes

• codename065 Premium Packages – Sell Digital Products Securely
• Cross-site scripting (XSS)

CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter

• codepeople CP Multi View Events Calendar
• Cross-site scripting (XSS)

User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field

• cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
• Cross-site scripting (XSS)

Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter

• themeum Tutor LMS – eLearning and online course solution
• Cross-site scripting (XSS)

NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route

• wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
• Cross-site scripting (XSS)

SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink

• gpriday SiteOrigin CSS
• Cross-site scripting (XSS)

SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector

• gpriday SiteOrigin CSS
• Cross-site scripting (XSS)

Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content

• johndarrel Hide My WP Ghost – Security & Firewall
• Cross-site scripting (XSS)

Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX

• wordpresschef Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
• Cross-site scripting (XSS)

Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter

• optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
• Cross-site scripting (XSS)

Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter

• optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
• Cross-site scripting (XSS)

Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}

• croixhaug Simply Schedule Appointments
• Cross-site scripting (XSS)

Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

• themefic Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
• Cross-site scripting (XSS)

User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

• cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
• Cross-site scripting (XSS)

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload

• themefic Ultra Addons for Contact Form 7
• Cross-site scripting (XSS)

Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute

• fullworks Quick PayPal Payments: Payment Button & Form
• Cross-site scripting (XSS)

SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field

• elvinhaci SQL Chart Builder
• Cross-site scripting (XSS)

Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

• magazine3 Schema & Structured Data for WP & AMP
• Cross-site scripting (XSS)

Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter

• mpol Gwolle Guestbook
• Cross-site scripting (XSS)

Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX

• kitae-park Mang Board
• Cross-site scripting (XSS)

Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter

• kitae-park Mang Board
• Cross-site scripting (XSS)

Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments

• extendthemes Colibri Page Builder
• Cross-site scripting (XSS)

RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL

• themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
• Cross-site scripting (XSS)

Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter

• Complianz GDPR/CCPA Cookie Consent Banner
• Cross-site scripting (XSS)

Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

• gijo Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
• Cross-site scripting (XSS)

Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

• goratech Cooked – Recipe Management
• Cross-site scripting (XSS)

WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute

• wppool Dark Mode – Improve Accessibility with AI Powered Dark Theme
• Cross-site scripting (XSS)

Cross-site scripting in Backdrop

• Backdrop
• Cross-site scripting (XSS)

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly int…

• Cross-site scripting (XSS)

Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

• Webkul Aureus ERP
• Cross-site scripting (XSS)

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

• Cross-site scripting (XSS)

>=1.143.12, <1.168.60 · fixed in 1.168.60

Vitess vttablet /twopcz reflected XSS

• Cross-site scripting (XSS)
• CWE-116

<0.23.5 || >=0.24.0, <0.24.2 · fixed in 0.23.5, 0.24.2