Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.7 High
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0
- dj-extensions.com DJ-HelpfulArticles extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass
- darylldoyle svg-sanitizer
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
- redaxo core
- Cross-site scripting (XSS)
- CVSS 2.1 Low
REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
- redaxo core
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
- redaxo core
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter
- SemanticMediaWiki
- Cross-site scripting (XSS)
- CVSS 8.3 High
Multiple vulnerabilities in Sisense’s Cloud BI Platform
- Sisense Cloud BI Platform
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter
- artbees Jupiter X Core
- Cross-site scripting (XSS)
- CVSS 7.2 High
Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title
- deconf Analytics Insights – Google Analytics Dashboard for WordPress
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting
- Saruf-Ratul HR-Payroll-Management-System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting
- MD-MAFUJUL-HASAN Online-Payroll-Management-System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Cross-site scripting in Ubiquiti Inc airMAX M
- Ubiquiti Inc airMAX M
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
- yeswiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
- yeswiki
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Argilla TextField.vue cross site scripting
- Argilla
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Argilla Sandbox.vue cross site scripting
- Argilla
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting
- Argilla
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode Airline Reservation System book_flight.php cross site scripting
- itsourcecode Airline Reservation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
subhajitkhan online-clinic-management-system patientregistration.php cross site scripting
- subhajitkhan online-clinic-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Stored Cross-Site Scripting in Web Interface
- WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
- WolfVision Cynap Pure (Next Gen), Cynap Bridge
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages
- asterisk
- certified-asterisk
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
BUG-000187164 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
BUG-000187165 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
BUG-000185167 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
- WP Chill Gallery PhotoBlocks
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability
- bPlugins Typing Text – Give your texts many typing effects
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
- bPlugins Button Block
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
- bPlugins Content Slider Block
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
- Bdtask Garage 24 Garage Management Software
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
- bPlugins LightBox Block
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
- WP Chill Gallery PhotoBlocks
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability
- TMS Amelia
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability
- Magepeople inc. WpEvently
- Cross-site scripting (XSS)
- CVSS 2.3 Low
HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes
- mganss HtmlSanitizer
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php
- francoisjacquet rosariosis
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL
- Webasyst Framework
- Cross-site scripting (XSS)
- CVSS 8.2 High
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7.
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetSmartFilters
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
- bPlugins Advanced Post Block - Post Grid for WordPress block editor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability
- bPlugins Panorama Viewer – 360 Degree Image + Video Viewer
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- bPlugins B Slider
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetElements For Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability
- Dylan Kuhn Geo Mashup
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability
- WP Smart Widgets Better Post & Filter Widgets for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability
- Kevin Weber Lazy Load for Videos
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- Igor Funa Ad Inserter
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability
- WProyal Royal Elementor Addons
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability
- WProyal Royal Elementor Addons
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability
- Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
- Cross-site scripting (XSS)