XSS
Monthly
An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerability is triggered, potentially exposing sensitive token information to the attacker.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gavias Halpes allows Reflected XSS.This issue affects Halpes: from n/a before 1.2.5.
Cross-site scripting in Portabilis i-Educar 2.9.0 allows an authenticated low-privilege user to inject malicious JavaScript through the unsanitized `Nome` parameter in the Curricular Components Module editor (`/module/ComponenteCurricular/edit`). When a victim with an active session views the affected component, the injected script executes in their browser context, enabling session hijacking or UI manipulation. A public proof-of-concept is available on GitHub, though EPSS at 0.03% (7th percentile) indicates negligible observed exploitation activity to date, and the vulnerability is not listed in CISA KEV.
Cross-site scripting (XSS) in Portabilis i-Educar 2.9.0 allows authenticated attackers to inject arbitrary web script via the 'Função' parameter in the Function Management module. A public exploit is available, but EPSS indicates low exploitation probability (0.03%). The vendor has not responded to disclosures.
Cross-site scripting in Portabilis i-Educar 2.9.0’s Course Module allows authenticated low-privilege users to inject malicious scripts via the ‘Curso’ parameter, potentially compromising other users’ sessions or data. A publicly available proof-of-concept exists, but exploitation requires user interaction and is not known to be actively exploited (EPSS score 0.03%).
Cross-site scripting in Portabilis i-Educar 2.9.0 allows authenticated low-privilege attackers to inject arbitrary web scripts via the 'Escola' parameter in the school module. Publicly available exploit code exists, but the vendor has not responded and no patch is available. EPSS score is low (0.03%), indicating low exploitation likelihood.
Cross-site scripting vulnerability in Portabilis i-Educar 2.9.0 allows a remote, authenticated attacker with low privileges to inject arbitrary web script via the Benefício parameter of the Student Benefits Registration page. When a victim views the maliciously crafted request, the script executes in the victim's browser, potentially leading to session hijacking or defacement. Publicly available exploit code exists, but no active exploitation has been confirmed.
User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110 and CVE-2024-12326), video and audio. However, it was possible to bypass this check by sending a manipulated MIME type containing a comma and an other MIME type like text/html (for example image/png,text/html). Browsers see multiple MIME types and text/html would takes precedence, allowing a possible attacker to do a cross-site scripting attack. The check for MIME types was enhanced to prevent a browser preview when the stored MIME type contains a comma.
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Reflected Cross-Site Scripting (XSS) in the JobSearch WordPress plugin (through version 2.9.0) allows unauthenticated attackers to inject web scripts by tricking a user into clicking a crafted link. The vulnerability could lead to cookie theft, session hijacking, or defacement, though EPSS predicts very low exploitation likelihood (0.03%) and no public exploit or active exploitation is known.
Reflected cross-site scripting in the WP-Recall WordPress plugin up to version 16.26.14 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. No public exploit or active exploitation is confirmed; the vulnerability has a low EPSS score of 0.03%.
Stored cross-site scripting in the Video List Manager WordPress plugin up to version 1.7 enables unauthenticated attackers to inject malicious scripts that execute in the browsers of users viewing affected pages, potentially leading to credential theft, session hijacking, or site defacement. No active exploitation has been reported, and EPSS score of 0.03% indicates a low probability of widespread exploitation in the wild. Exploitation requires user interaction, as the victim must visit the compromised page.
Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin (versions through 4.6.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL. Successful exploitation can lead to session token theft, credential harvesting, or malicious redirect depending on attacker-controlled payload. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% reflects low current exploitation probability.
Reflected cross-site scripting in the Neom Blog WordPress theme (versions up to 0.0.9) allows unauthenticated
Reflected DOM-based cross-site scripting (XSS) in the WordPress Team Showcase plugin (versions prior to 25.05.13) allows unauthenticated attackers to inject arbitrary scripts via a crafted URL. When a logged-in user or other site visitor clicks the link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. No public exploit code or active exploitation has been reported, and the vendor has released patch version 25.05.13.
Reflected cross-site scripting in the Testimonials Showcase WordPress plugin through version 1.9.16 allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user's browser session. An attacker can craft a malicious link that, when clicked by a user (any role) with an active WordPress session, will execute the attacker-supplied code, potentially stealing session tokens, defacing the page, or performing actions on the user's behalf. No active exploitation or public proof-of-concept is known at this time, and EPSS indicates very low exploitation probability (0.03%).
Stored cross-site scripting vulnerability in the Booking Calendar Contact Form plugin for WordPress allows authenticated users with low privileges to inject arbitrary JavaScript into stored booking entries. When other users view these entries, the script executes, potentially leading to session theft or site defacement. No active exploitation or public exploit code has been identified, and the EPSS probability is very low (0.03%).
Reflected cross-site scripting in the Rankie WordPress plugin up to version 1.8.2 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. An attacker can trick a logged-in user into clicking the link, potentially leading to session cookie theft or credential phishing. No active exploitation is confirmed and no public exploit code has been identified.
Reflected Cross-Site Scripting in the Pressroom - News Magazine WordPress Theme (QuanticaLabs) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. All theme versions through 6.9 are affected. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS sits at 0.03% (9th percentile), consistent with a niche WordPress theme with limited real-world deployment.
Reflected cross-site scripting in the Homey WordPress theme (versions ≤2.4.5) allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability has a CVSS score of 7.1 (High) but an EPSS probability of 0.03%, indicating minimal exploitation likelihood; no active exploitation or public exploit code has been reported.
Reflected Cross-Site Scripting (XSS) in the SB Breadcrumbs WordPress plugin up to version 1.0 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL, potentially hijacking user sessions, defacing the site, or redirecting visitors to malicious pages. No active exploitation or public exploit code has been identified at this time.
Stored cross-site scripting in the WebEmailProtector WordPress plugin (≤3.3.6) allows authenticated attackers with low-privilege accounts (e.g., Contributor) to inject malicious scripts into plugin settings, causing script execution in administrators' browsers. No public exploit or active exploitation has been reported, and EPSS probability is very low (0.03%).
Reflected cross-site scripting (XSS) in WP Wall ≤1.7.3 lets attackers execute arbitrary JavaScript in victims' browsers via crafted links. The WordPress plugin fails to properly sanitize reflected input, requiring user interaction. No active exploitation or public exploit is confirmed, and EPSS probability is very low (0.03%).
Reflected cross-site scripting in the OTWthemes Content Manager Light WordPress plugin through version 3.2 allows an unauthenticated attacker to inject arbitrary web scripts. Successful exploitation requires tricking an authenticated administrator into clicking a crafted link, after which the attacker may steal session tokens, deface content, or perform other actions in the victim’s browser context. At the time of analysis, no public exploit code or active exploitation has been identified.
Stored cross-site scripting (XSS) vulnerability in the WP Visitor Statistics (Real Time Traffic) plugin for WordPress versions up to 7.8 allows authenticated attackers with low privileges to inject malicious scripts into the statistics display pages. When an administrator views the affected page, the script executes in their browser, potentially leading to session hijacking, data theft, or administrative actions. Currently no public exploit or active exploitation has been reported, and the EPSS score is low (0.03%), indicating limited immediate risk.
DOM-based cross-site scripting in the WordPress Card flip image slideshow plugin (<= 1.5) allows authenticated attackers to execute arbitrary JavaScript in victims’ browsers. Exploitation requires at least contributor-level access and user interaction; impact includes session theft and defacement. No evidence of active exploitation or public exploit code exists, and EPSS indicates a very low probability of real-world attacks.
DOM-based Cross-Site Scripting (XSS) in Aakif Kadiwala Posts Slider Shortcode plugin for WordPress up to version 1.0 allows authenticated attackers with low-level privileges to execute arbitrary scripts in the browsers of site visitors who view a vulnerable page. Exploitation could lead to session hijacking, defacement, or redirection. No active exploitation is confirmed, and EPSS estimates only a 0.03% probability of widespread exploitation, indicating low real-world risk despite the medium CVSS score.
Stored cross-site scripting (XSS) in the OwnerRez WordPress plugin up to version 1.2.1 allows authenticated attackers with low-level privileges to inject malicious web scripts. When an administrator or other user views the affected page, the script executes in their browser, potentially leading to session hijacking, defacement, or phishing. No active exploitation or public exploit is currently known, and the vulnerability carries a low EPSS score (0.03%), indicating minimal immediate threat.
Stored cross-site scripting in N-Media Frontend File Manager plugin for WordPress (≤23.2) allows authenticated, low-privileged users to inject script tags into filenames or content. An attacker with upload permissions can craft a malicious file that, when rendered in the frontend manager interface, executes arbitrary JavaScript in the browser of any user who views it. No public exploit or active exploitation has been observed; the EPSS score is very low at 0.03%.
Stored cross-site scripting in bPlugins Video Gallery Block plugin for WordPress allows authenticated attackers to inject malicious scripts that execute in the browsers of other users, including administrators. Versions up to 1.1.0 are affected. No public exploit or active exploitation reported; EPSS indicates very low exploitation probability (0.03%).
Stored cross-site scripting in WP fancybox plugin through version 1.0.4 allows authenticated attackers to inject malicious scripts into pages viewed by other users. No known public exploit or active exploitation has been identified, and EPSS indicates low exploitation likelihood.
DOM-based cross-site scripting in the (Simply) Guest Author Name WordPress plugin through version 4.36 allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When an administrator or other high-privileged user views a page containing the malicious payload, the script executes in their browser, potentially leading to session theft, defacement, or unauthorized actions. No active exploitation or public proof-of-concept is known, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in the MyRewards WordPress plugin up to 5.4.13.1 allows unauthenticated attackers to inject scripts that execute in other users' browsers, potentially leaking sensitive session information (CVSS 5.3). No active exploitation or public exploit is known, and EPSS shows very low exploitation probability (0.03%).
Stored cross-site scripting in Chatra Live Chat + ChatBot + Cart Saver WordPress plugin through 1.0.11 allows authenticated users with low privileges to inject scripts that execute in administrative contexts, leading to availability impacts. No active exploitation or public exploit has been identified, and EPSS indicates a very low likelihood of widespread attacks.
The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsc_eprm_menu_link shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 is able to address this issue. The patch is named bdcd5e3bc651c0839c7eea807f3eb6af856dbc76. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional. A patch and new release was made available very quickly.
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Stored cross-site scripting in the Smart Docs WordPress plugin allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the 'smartdocs_search' shortcode. Versions up to and including 1.1.0 are affected. No public exploit has been identified at the time of analysis, and the EPSS exploitation probability is low (0.03%), reducing immediate risk.
The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.
Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MassEditRegex Extension allows Stored XSS.This issue affects Mediawiki - MassEditRegex Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GoogleDocs4MW Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - CampaignEvents Extension: from 1.43.X before 1.43.2.
Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.
Stored cross-site scripting (XSS) in the PublishPress Gutenberg Blocks WordPress plugin (up to version 3.3.1) allows authenticated attackers with low privileges to inject arbitrary JavaScript via specially crafted blocks. When an administrator or other user views the malicious content, the script executes in their browser, potentially leading to session hijacking, credential theft, or site defacement. No active exploitation or public exploit code has been identified.
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.
Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the footer_text and announcement parameters in config.php.
Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the replace parameter in /config.php/tags.
Stored cross-site scripting vulnerability in the prettyPhoto library (version 3.1.6) bundled in multiple WordPress plugins allows authenticated attackers with contributor-level access to inject arbitrary scripts that execute in pages viewed by site visitors. The vulnerability is due to insufficient input sanitization and output escaping on user-supplied attributes when using the library's gallery functionality. No public exploit or active exploitation has been identified at the time of analysis; the EPSS score (0.06%) indicates a low probability of exploitation.
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects.
The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when the website is loaded.
The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’s browser when an authenticated administrator clicks the link.
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including, 6.4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Laundry on Linux, MacOS allows Account Takeover. This issue affects Laundry: 2.3.0.
Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting (XSS) vulnerability in both topic names and channel names. This issue has been fixed in Zulip Server 10.4. A workaround for this issue involves denying access to /digest/.
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension allows Stored XSS.This issue affects Mediawiki - TwoColConflict Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
The All-in-One Addons for Elementor - WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Cross-site scripting vulnerability exists in Active! mail 6 BuildInfo: 6.30.01004145 to 6.60.06008562. If this vulnerability is exploited, an arbitrary script may be executed on the logged-in user's web browser when the user is accessing a specially crafted URL.
Stored cross-site scripting in Magic Buttons for Elementor WordPress plugin versions ≤1.0 allows authenticated attackers with Contributor-level access to inject arbitrary scripts via the magic-button shortcode, executing in the browsers of any user viewing the affected page. No active exploitation or public exploit code is known, and EPSS probability is extremely low (0.03%).
Stored cross-site scripting vulnerability in the Magic Buttons for Elementor WordPress plugin allows authenticated attackers with contributor-level access to inject arbitrary web scripts via the magic-button shortcode. The flaw exists in all versions up to and including 1.0 due to insufficient input sanitization. No public exploit has been identified, and EPSS score is very low (0.03%), indicating minimal exploitation risk at this time.
The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected execution of scripts in the browser on interaction.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
The Dear Flipbook - PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data.
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.
IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Devinim Software Library Software allows Reflected XSS.This issue affects Library Software: before 24.11.02.
IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product.
An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerability is triggered, potentially exposing sensitive token information to the attacker.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gavias Halpes allows Reflected XSS.This issue affects Halpes: from n/a before 1.2.5.
Cross-site scripting in Portabilis i-Educar 2.9.0 allows an authenticated low-privilege user to inject malicious JavaScript through the unsanitized `Nome` parameter in the Curricular Components Module editor (`/module/ComponenteCurricular/edit`). When a victim with an active session views the affected component, the injected script executes in their browser context, enabling session hijacking or UI manipulation. A public proof-of-concept is available on GitHub, though EPSS at 0.03% (7th percentile) indicates negligible observed exploitation activity to date, and the vulnerability is not listed in CISA KEV.
Cross-site scripting (XSS) in Portabilis i-Educar 2.9.0 allows authenticated attackers to inject arbitrary web script via the 'Função' parameter in the Function Management module. A public exploit is available, but EPSS indicates low exploitation probability (0.03%). The vendor has not responded to disclosures.
Cross-site scripting in Portabilis i-Educar 2.9.0’s Course Module allows authenticated low-privilege users to inject malicious scripts via the ‘Curso’ parameter, potentially compromising other users’ sessions or data. A publicly available proof-of-concept exists, but exploitation requires user interaction and is not known to be actively exploited (EPSS score 0.03%).
Cross-site scripting in Portabilis i-Educar 2.9.0 allows authenticated low-privilege attackers to inject arbitrary web scripts via the 'Escola' parameter in the school module. Publicly available exploit code exists, but the vendor has not responded and no patch is available. EPSS score is low (0.03%), indicating low exploitation likelihood.
Cross-site scripting vulnerability in Portabilis i-Educar 2.9.0 allows a remote, authenticated attacker with low privileges to inject arbitrary web script via the Benefício parameter of the Student Benefits Registration page. When a victim views the maliciously crafted request, the script executes in the victim's browser, potentially leading to session hijacking or defacement. Publicly available exploit code exists, but no active exploitation has been confirmed.
User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110 and CVE-2024-12326), video and audio. However, it was possible to bypass this check by sending a manipulated MIME type containing a comma and an other MIME type like text/html (for example image/png,text/html). Browsers see multiple MIME types and text/html would takes precedence, allowing a possible attacker to do a cross-site scripting attack. The check for MIME types was enhanced to prevent a browser preview when the stored MIME type contains a comma.
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Reflected Cross-Site Scripting (XSS) in the JobSearch WordPress plugin (through version 2.9.0) allows unauthenticated attackers to inject web scripts by tricking a user into clicking a crafted link. The vulnerability could lead to cookie theft, session hijacking, or defacement, though EPSS predicts very low exploitation likelihood (0.03%) and no public exploit or active exploitation is known.
Reflected cross-site scripting in the WP-Recall WordPress plugin up to version 16.26.14 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. No public exploit or active exploitation is confirmed; the vulnerability has a low EPSS score of 0.03%.
Stored cross-site scripting in the Video List Manager WordPress plugin up to version 1.7 enables unauthenticated attackers to inject malicious scripts that execute in the browsers of users viewing affected pages, potentially leading to credential theft, session hijacking, or site defacement. No active exploitation has been reported, and EPSS score of 0.03% indicates a low probability of widespread exploitation in the wild. Exploitation requires user interaction, as the victim must visit the compromised page.
Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin (versions through 4.6.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL. Successful exploitation can lead to session token theft, credential harvesting, or malicious redirect depending on attacker-controlled payload. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% reflects low current exploitation probability.
Reflected cross-site scripting in the Neom Blog WordPress theme (versions up to 0.0.9) allows unauthenticated
Reflected DOM-based cross-site scripting (XSS) in the WordPress Team Showcase plugin (versions prior to 25.05.13) allows unauthenticated attackers to inject arbitrary scripts via a crafted URL. When a logged-in user or other site visitor clicks the link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. No public exploit code or active exploitation has been reported, and the vendor has released patch version 25.05.13.
Reflected cross-site scripting in the Testimonials Showcase WordPress plugin through version 1.9.16 allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user's browser session. An attacker can craft a malicious link that, when clicked by a user (any role) with an active WordPress session, will execute the attacker-supplied code, potentially stealing session tokens, defacing the page, or performing actions on the user's behalf. No active exploitation or public proof-of-concept is known at this time, and EPSS indicates very low exploitation probability (0.03%).
Stored cross-site scripting vulnerability in the Booking Calendar Contact Form plugin for WordPress allows authenticated users with low privileges to inject arbitrary JavaScript into stored booking entries. When other users view these entries, the script executes, potentially leading to session theft or site defacement. No active exploitation or public exploit code has been identified, and the EPSS probability is very low (0.03%).
Reflected cross-site scripting in the Rankie WordPress plugin up to version 1.8.2 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. An attacker can trick a logged-in user into clicking the link, potentially leading to session cookie theft or credential phishing. No active exploitation is confirmed and no public exploit code has been identified.
Reflected Cross-Site Scripting in the Pressroom - News Magazine WordPress Theme (QuanticaLabs) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. All theme versions through 6.9 are affected. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS sits at 0.03% (9th percentile), consistent with a niche WordPress theme with limited real-world deployment.
Reflected cross-site scripting in the Homey WordPress theme (versions ≤2.4.5) allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability has a CVSS score of 7.1 (High) but an EPSS probability of 0.03%, indicating minimal exploitation likelihood; no active exploitation or public exploit code has been reported.
Reflected Cross-Site Scripting (XSS) in the SB Breadcrumbs WordPress plugin up to version 1.0 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL, potentially hijacking user sessions, defacing the site, or redirecting visitors to malicious pages. No active exploitation or public exploit code has been identified at this time.
Stored cross-site scripting in the WebEmailProtector WordPress plugin (≤3.3.6) allows authenticated attackers with low-privilege accounts (e.g., Contributor) to inject malicious scripts into plugin settings, causing script execution in administrators' browsers. No public exploit or active exploitation has been reported, and EPSS probability is very low (0.03%).
Reflected cross-site scripting (XSS) in WP Wall ≤1.7.3 lets attackers execute arbitrary JavaScript in victims' browsers via crafted links. The WordPress plugin fails to properly sanitize reflected input, requiring user interaction. No active exploitation or public exploit is confirmed, and EPSS probability is very low (0.03%).
Reflected cross-site scripting in the OTWthemes Content Manager Light WordPress plugin through version 3.2 allows an unauthenticated attacker to inject arbitrary web scripts. Successful exploitation requires tricking an authenticated administrator into clicking a crafted link, after which the attacker may steal session tokens, deface content, or perform other actions in the victim’s browser context. At the time of analysis, no public exploit code or active exploitation has been identified.
Stored cross-site scripting (XSS) vulnerability in the WP Visitor Statistics (Real Time Traffic) plugin for WordPress versions up to 7.8 allows authenticated attackers with low privileges to inject malicious scripts into the statistics display pages. When an administrator views the affected page, the script executes in their browser, potentially leading to session hijacking, data theft, or administrative actions. Currently no public exploit or active exploitation has been reported, and the EPSS score is low (0.03%), indicating limited immediate risk.
DOM-based cross-site scripting in the WordPress Card flip image slideshow plugin (<= 1.5) allows authenticated attackers to execute arbitrary JavaScript in victims’ browsers. Exploitation requires at least contributor-level access and user interaction; impact includes session theft and defacement. No evidence of active exploitation or public exploit code exists, and EPSS indicates a very low probability of real-world attacks.
DOM-based Cross-Site Scripting (XSS) in Aakif Kadiwala Posts Slider Shortcode plugin for WordPress up to version 1.0 allows authenticated attackers with low-level privileges to execute arbitrary scripts in the browsers of site visitors who view a vulnerable page. Exploitation could lead to session hijacking, defacement, or redirection. No active exploitation is confirmed, and EPSS estimates only a 0.03% probability of widespread exploitation, indicating low real-world risk despite the medium CVSS score.
Stored cross-site
Stored cross-site scripting (XSS) in the OwnerRez WordPress plugin up to version 1.2.1 allows authenticated attackers with low-level privileges to inject malicious web scripts. When an administrator or other user views the affected page, the script executes in their browser, potentially leading to session hijacking, defacement, or phishing. No active exploitation or public exploit is currently known, and the vulnerability carries a low EPSS score (0.03%), indicating minimal immediate threat.
Stored cross-site scripting in N-Media Frontend File Manager plugin for WordPress (≤23.2) allows authenticated, low-privileged users to inject script tags into filenames or content. An attacker with upload permissions can craft a malicious file that, when rendered in the frontend manager interface, executes arbitrary JavaScript in the browser of any user who views it. No public exploit or active exploitation has been observed; the EPSS score is very low at 0.03%.
Stored cross-site scripting in bPlugins Video Gallery Block plugin for WordPress allows authenticated attackers to inject malicious scripts that execute in the browsers of other users, including administrators. Versions up to 1.1.0 are affected. No public exploit or active exploitation reported; EPSS indicates very low exploitation probability (0.03%).
Stored cross-site scripting in WP fancybox plugin through version 1.0.4 allows authenticated attackers to inject malicious scripts into pages viewed by other users. No known public exploit or active exploitation has been identified, and EPSS indicates low exploitation likelihood.
DOM-based cross-site scripting in the (Simply) Guest Author Name WordPress plugin through version 4.36 allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When an administrator or other high-privileged user views a page containing the malicious payload, the script executes in their browser, potentially leading to session theft, defacement, or unauthorized actions. No active exploitation or public proof-of-concept is known, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in the MyRewards WordPress plugin up to 5.4.13.1 allows unauthenticated attackers to inject scripts that execute in other users' browsers, potentially leaking sensitive session information (CVSS 5.3). No active exploitation or public exploit is known, and EPSS shows very low exploitation probability (0.03%).
Stored cross-site scripting in Chatra Live Chat + ChatBot + Cart Saver WordPress plugin through 1.0.11 allows authenticated users with low privileges to inject scripts that execute in administrative contexts, leading to availability impacts. No active exploitation or public exploit has been identified, and EPSS indicates a very low likelihood of widespread attacks.
The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsc_eprm_menu_link shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 is able to address this issue. The patch is named bdcd5e3bc651c0839c7eea807f3eb6af856dbc76. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional. A patch and new release was made available very quickly.
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Stored cross-site scripting in the Smart Docs WordPress plugin allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the 'smartdocs_search' shortcode. Versions up to and including 1.1.0 are affected. No public exploit has been identified at the time of analysis, and the EPSS exploitation probability is low (0.03%), reducing immediate risk.
The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.
Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MassEditRegex Extension allows Stored XSS.This issue affects Mediawiki - MassEditRegex Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GoogleDocs4MW Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - CampaignEvents Extension: from 1.43.X before 1.43.2.
Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.
Stored cross-site scripting (XSS) in the PublishPress Gutenberg Blocks WordPress plugin (up to version 3.3.1) allows authenticated attackers with low privileges to inject arbitrary JavaScript via specially crafted blocks. When an administrator or other user views the malicious content, the script executes in their browser, potentially leading to session hijacking, credential theft, or site defacement. No active exploitation or public exploit code has been identified.
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.
Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the footer_text and announcement parameters in config.php.
Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the replace parameter in /config.php/tags.
Stored cross-site scripting vulnerability in the prettyPhoto library (version 3.1.6) bundled in multiple WordPress plugins allows authenticated attackers with contributor-level access to inject arbitrary scripts that execute in pages viewed by site visitors. The vulnerability is due to insufficient input sanitization and output escaping on user-supplied attributes when using the library's gallery functionality. No public exploit or active exploitation has been identified at the time of analysis; the EPSS score (0.06%) indicates a low probability of exploitation.
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects.
The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when the website is loaded.
The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’s browser when an authenticated administrator clicks the link.
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including, 6.4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Laundry on Linux, MacOS allows Account Takeover. This issue affects Laundry: 2.3.0.
Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting (XSS) vulnerability in both topic names and channel names. This issue has been fixed in Zulip Server 10.4. A workaround for this issue involves denying access to /digest/.
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension allows Stored XSS.This issue affects Mediawiki - TwoColConflict Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
The All-in-One Addons for Elementor - WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Cross-site scripting vulnerability exists in Active! mail 6 BuildInfo: 6.30.01004145 to 6.60.06008562. If this vulnerability is exploited, an arbitrary script may be executed on the logged-in user's web browser when the user is accessing a specially crafted URL.
Stored cross-site scripting in Magic Buttons for Elementor WordPress plugin versions ≤1.0 allows authenticated attackers with Contributor-level access to inject arbitrary scripts via the magic-button shortcode, executing in the browsers of any user viewing the affected page. No active exploitation or public exploit code is known, and EPSS probability is extremely low (0.03%).
Stored cross-site scripting vulnerability in the Magic Buttons for Elementor WordPress plugin allows authenticated attackers with contributor-level access to inject arbitrary web scripts via the magic-button shortcode. The flaw exists in all versions up to and including 1.0 due to insufficient input sanitization. No public exploit has been identified, and EPSS score is very low (0.03%), indicating minimal exploitation risk at this time.
The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected execution of scripts in the browser on interaction.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
The Dear Flipbook - PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data.
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.
IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Devinim Software Library Software allows Reflected XSS.This issue affects Library Software: before 24.11.02.
IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product.