XSS
Monthly
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. The plugin is disabled by default.
Cross-site scripting in code-projects Simple Forum 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the /forum_edit1.php text parameter. The attack can be carried out by an authenticated user and executes when another user views the manipulated page. Public exploit code is available, but EPSS data indicates very low exploitation probability.
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP VR - 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Stored cross-site scripting (XSS) in code-projects Food Distributor Site 1.0 allows an authenticated administrator to inject arbitrary JavaScript into site settings. The vulnerability is triggered via the site_phone, site_email, or address parameters in the /admin/save_settings.php endpoint. Public exploit code is available, but the high privilege requirement (administrator access) and low EPSS score (0.07%) limit real-world risk.
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.
A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. The name field fails to properly sanitize user input, allowing an attacker to inject malicious JavaScript.
IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Stored XSS via cross-site request forgery in the re.place WordPress plugin allows an attacker to store malicious scripts by tricking a logged-in administrator into clicking a crafted link. The vulnerability affects versions up to 0.2.1, and no active exploitation or public exploit code has been identified at the time of analysis.
Stored XSS in the My Resume Builder WordPress plugin (versions through 1.0.3) enables authenticated contributors to inject persistent JavaScript payloads into resume content that executes in the browsers of other users who view it. When a privileged user such as an administrator views the affected page, the injected script runs in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the EPSS score of 0.04% indicates negligible observed exploitation interest.
Stored Cross-Site Scripting (XSS) in the RSS Digest WordPress plugin (versions up to 1.5) can be exploited via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to trick site administrators into performing actions that inject malicious scripts. The injected payload persists and executes in the browsers of other users, leading to content manipulation, session theft, or site defacement. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability.
Cross-site request forgery in the Społecznościowa 6 PL 2013 WordPress plugin (versions <= 2.0.6) allows unauthenticated attackers to trick an administrator into executing unintended actions, leading to stored cross-site scripting. This enables injection of malicious scripts that execute in the browsers of other users, potentially stealing session cookies, defacing the site, or redirecting visitors. No active exploitation is confirmed, and the EPSS score is very low (0.02%).
Stored cross-site scripting in the WordPress plugin Beauty Contact Popup Form up to version 6.0 enables authenticated attackers with high privileges to inject malicious scripts that execute when other users view stored contact form data. This issue has a medium CVSS score and low EPSS exploitation probability, with no known active exploitation or public exploit code.
DOM-based cross-site scripting in the WordPress Raise The Money plugin allows authenticated attackers with low privileges to inject malicious scripts, leading to code execution in victims' browsers. No active exploitation or public exploit code has been observed, and EPSS predicts a 0.04% chance of exploitation, indicating very low real-world risk.
Cross-site scripting in Free Downloads EDD WordPress plugin allows DOM-based XSS attacks against authenticated users with low privileges, potentially leading to session hijacking or malicious actions. The vulnerability affects versions up to 1.0.4 and has a low exploitation likelihood (EPSS 0.04%) with no public exploit or active exploitation reported.
Stored Cross-Site
Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.
Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.
Reflected XSS vulnerability in WordPress
Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.
Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full
DOM-Based Cross-Site Scripting in the Theme Junkie Team Content WordPress plugin (versions through 0.1.1) allows a low-privileged authenticated attacker to inject malicious scripts that execute in the browser of any user who views the affected page. Because the scope changes (S:C in the CVSS vector), the injected script can access session cookies and perform actions on behalf of higher-privileged users such as administrators. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.04% reflects very low observed exploitation probability.
Stored cross-site scripting in the WordPress Podcast Feed Player Widget and Shortcode plugin up to version 2.2.0 allows authenticated contributors to inject arbitrary JavaScript through shortcode or widget inputs. When an administrator views the affected page, the script executes in the admin's browser context, enabling session theft or actions on behalf of the admin. No evidence of active exploitation (CISA KEV not listed) and EPSS score is low (0.04%), reducing immediate priority.
Stored cross-site scripting in the EC Stars Rating WordPress plugin (versions ≤1.0.11) allows authenticated administrators to inject malicious scripts that execute in the browsers of other users who view the affected rating page. This could lead to session hijacking, defacement, or other browser-based attacks.
Stored cross-site scripting (XSS) in the Smart Agenda WordPress plugin up to version 4.9 allows authenticated attackers with low-privilege accounts to inject malicious scripts that execute in the browsers of users viewing the compromised content. No known public exploit or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.04% indicates a very low probability of exploitation in the wild.
DOM-based XSS in the WP DataTable WordPress plugin (versions up to and including 0.2.7) allows a low-privileged authenticated attacker to inject malicious client-side scripts that execute in a victim's browser session. The flaw is classified under CWE-79 and arises from insufficient input neutralization in a DOM manipulation path, meaning the payload is processed by the browser rather than the server. No public exploit code and no CISA KEV listing have been identified at the time of analysis; EPSS at 0.04% reflects a low near-term exploitation probability.
Stored cross-site scripting in the WordPress plugin WP Visual Sitemap up to version 1.0.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into sitemap content. When an administrator or other privileged user views the affected content, the script executes in their browser, enabling session hijacking or site defacement. No public exploit or active exploitation is known, and EPSS probability is very low (0.04%).
Stored cross-site scripting in the Quick Favicon WordPress plugin ≤0.22.8 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when another user views an affected page. No known public exploit or active exploitation has been reported, and EPSS indicates a very low probability of widespread use.
Stored cross-site scripting (XSS) in the Affiliate Links for Amazon WordPress plugin (versions up to 1.0.6) allows an authenticated attacker with high privileges to inject arbitrary scripts that execute when another user views the affected page. No public exploit or active exploitation has been identified, and the EPSS score indicates very low exploitation probability (0.04%).
Stored cross-site scripting in WordPress Thumbnail Editor plugin ≤2.3.3 allows authenticated users with low privileges to inject arbitrary web scripts that execute when an administrator views the affected content, potentially leading to privilege escalation or data theft. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.04%).
Stored cross-site scripting in the Football Pool WordPress plugin (≤2.12.5) enables authenticated attackers to inject malicious scripts into pages viewed by other users. Successful exploitation requires user interaction to trigger the stored payload, leading to potential data theft or session compromise. EPSS indicates very low current exploitation probability (0.04%).
DOM-Based Cross-Site Scripting (XSS) in the Popup addon for Ninja Forms WordPress plugin up to version 3.4 allows authenticated attackers with at least contributor-level access to inject and execute arbitrary JavaScript in the browser of a victim who interacts with a crafted popup. Successful exploitation could lead to session hijacking, credential theft, or complete site takeover in the context of a higher-privileged user. No active exploitation or public exploit code is known at this time, and the EPSS exploitation probability is low (0.04%).
Stored Cross-Site Scripting in WP AdCenter plugin up to version 2.6.0 allows authenticated users with low-level privileges to inject malicious scripts into ad content, which execute in the browsers of administrators viewing the affected pages, potentially leading to session hijacking or privilege escalation. No active exploitation or public exploit code has been identified, and the EPSS score indicates a very low probability of widespread exploitation.
DOM-based Cross-Site Scripting (XSS) in the Omnipress WordPress plugin through version 1.6.3 allows authenticated attackers with low privileges (e.g., contributor accounts) to inject malicious scripts that execute in the browser of an administrator or other user. The vulnerability is triggered via crafted page content and requires victim interaction (e.g., visiting a page). No active exploitation or public proof-of-concept has been identified, and the EPSS score is very low (0.04%), indicating minimal current exploitation risk.
DOM-based cross-site scripting (XSS) vulnerability in the VaultDweller Leyka WordPress plugin (versions ≤3.31.9) allows authenticated attackers to inject arbitrary JavaScript into pages viewed by other users. Successful exploitation requires a low-privileged attacker account and user interaction, potentially leading to session hijacking or page manipulation. No active exploitation or public exploit code has been confirmed at this time.
Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.
Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) in the Additional Order Filters for WooCommerce WordPress plugin up to version 1.22 allows unauthenticated attackers to inject malicious scripts that execute in the context of an admin user. Exploitation requires tricking a logged-in administrator into clicking a crafted link, resulting in script storage that can compromise other admins' sessions and site data. The vulnerability has a CVSS base score of 7.1 but an extremely low EPSS exploitation probability (0.02%), and no active exploitation or public exploit code has been identified.
Stored cross-site scripting (XSS) in the WP Edit WordPress plugin through version 4.0.4 allows authenticated attackers with high privileges (such as administrators) to inject arbitrary web scripts into pages. These scripts execute in the browsers of other users who later view the affected content, enabling session hijacking, defacement, or theft of sensitive data. No public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low current exploitation probability.
Stored cross-site scripting in HT Mega – Absolute Addons for WPBakery Page Builder allows authenticated attackers with low privileges to inject arbitrary web scripts. When an administrator or other high-privilege user views the injected content, the script executes in their browser, leading to session theft, account takeover, or site defacement. The vulnerability affects all versions up to 1.0.8; no active exploitation or public exploit code is known, and the EPSS probability is low.
DOM-based cross-site scripting in the CyberChimps Responsive Blocks WordPress plugin allows authenticated attackers to inject arbitrary JavaScript. The vulnerability affects plugin versions up to 2.0.6 and can be exploited by low-privileged users who create malicious block content, leading to script execution in the browsers of victims who view the affected page. No active exploitation or public exploit code has been identified at this time.
A DOM-based cross-site scripting (XSS) vulnerability in the HT Slider For Elementor WordPress plugin up to version 1.
Reflected cross-site scripting in the LMS WordPress theme by designthemes allows unauthenticated attackers to execute arbitrary scripts in a victim's browser via a crafted link, affecting all versions up to 9.1. User interaction is required, enabling session hijacking or data theft. No public exploit code or active exploitation has been identified, and EPSS predicts very low exploitation likelihood.
Reflected Cross-Site Scripting in the xili-dictionary WordPress plugin through version 2.12.5.2 allows attackers to execute arbitrary scripts in a victim's browser. A remote attacker can craft a malicious link that, when clicked by a user visiting an affected site, can steal cookies, redirect browsers, or deface content. No active exploitation or public exploit is currently known, and EPSS indicates a low probability of widespread exploitation.
Reflected cross-site scripting in the Infility Global WordPress plugin (≤2.12.7) allows unauthenticated remote attackers to execute arbitrary script in a victim's browser via a crafted link. No public exploit or active exploitation has been identified; the EPSS score is 0.04%, indicating low exploitation probability despite a CVSS 3.1 score of 7.1.
Reflected Cross-Site Scripting in the CSS3 Vertical Web Pricing Tables WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Version 1.9 and earlier are affected, and exploitation requires a victim to click a crafted link. No active exploitation or public exploit code has been reported, and the EPSS score of 0.04% indicates a very low probability of real-world attacks.
Unauthenticated remote attackers can inject arbitrary web scripts via a crafted URL due to improper input sanitization in the Flexo Counter WordPress plugin through version 1.0001. When a victim clicks the link, malicious JavaScript executes in their browser, potentially leading to session theft or defacement. No active exploitation or public exploit is confirmed, and EPSS indicates very low exploitation probability (0.04%, 13th percentile).
Reflected cross-site scripting in the Bulk YouTube Post Creator WordPress plugin up to version 1.0 allows unauthenticated attackers to inject malicious scripts by tricking an authenticated user into clicking a crafted link. An attacker could hijack the victim's session, steal sensitive data, or perform actions on the victim's behalf within the context of the affected site. EPSS indicates very low exploitation probability (0.04%), and no active exploitation has been confirmed.
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Reflected cross-site scripting in the Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin up to version 0.5.8.4 allows unauthenticated attackers to inject arbitrary web scripts via crafted requests. Successful exploitation requires a victim to click a malicious link, leading to script execution in the victim's browser, which may steal session cookies or deface pages. No evidence of active exploitation or public exploit code exists at this time.
Reflected cross-site scripting (XSS) in the WordPress plugin FormLift for Infusionsoft Web Forms (versions up to 7.5.20) allows remote unauthenticated attackers to inject arbitrary web scripts via user-supplied input. Exploitation requires a victim to click a malicious link, but can lead to session theft, phishing, and other browser-based attacks. The vulnerability carries a CVSS score of 7.1, though EPSS indicates a very low (0.04%) probability of exploitation; no active exploitation or public exploit code has been identified.
Reflected Cross-Site Scripting (XSS) in the mojoomla School Management WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts via unsanitized input, exploiting victims who click a crafted link. This vulnerability affects plugin versions through 92.0.0, with no known public exploit or active exploitation reported at the time of analysis.
Reflected cross-site scripting in the Sneeit MagOne WordPress theme up to version 8.5 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a specially crafted link. This can lead to session hijacking, data theft, or site defacement. No public exploit or active exploitation has been reported, and the EPSS probability is very low at 0.04%.
Reflected cross-site scripting in the Smart Notification WordPress plugin up to version 10.3 enables unauthenticated attackers to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link. This can lead to session hijacking, credential theft, or malicious actions on behalf of the victim. While no active exploitation or public exploit code is currently reported, the low CVSS impact and very low EPSS score suggest limited real-world risk at this time.
Reflected cross-site scripting in the HYDRO WordPress theme (versions ≤2.8) allows unauthenticated attackers to inject arbitrary web scripts after a victim clicks a crafted link, enabling session hijacking or unauthorized actions in the victim's browser. No public exploit code or active exploitation was identified at time of analysis, and EPSS predicts very low exploitation probability (0.04%).
Stored cross-site scripting in the Seven Stars WordPress theme by themeton allows unauthenticated attackers to inject malicious scripts into the site that execute when other users-such as admins-view the affected page. The vulnerability affects versions 1.4.4 and earlier, and while no active exploitation has been confirmed, publicly available proof-of-concept exploits likely exist given the nature of stored XSS. CVSS 7.1 indicates high severity, but EPSS estimates only a 0.04% probability of exploitation.
Stored cross-site scripting in Woocommerce Line Notify plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts that execute when a victim views an affected page, potentially leading to session hijacking or unauthorized actions. All versions up to 1.1.7 are vulnerable; no active exploitation or public proof-of-concept has been confirmed despite a High CVSS score of 7.1. The EPSS score of 0.04% indicates extremely low likelihood of real-world exploitation at this time.
Reflected cross-site scripting (XSS) in the WP Front User Submit / Front Editor WordPress plugin versions up to 4.9.3 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. The attack requires user interaction (e.g., clicking a link) and can lead to script execution in the victim’s browser, potentially enabling data theft or defacement. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread exploitation.
Reflected cross-site scripting in the Evangelische Termine WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a malicious link. Versions up to and including 3.3 are affected. Exploitation requires user interaction, and no active exploitation or public proof-of-concept has been identified at this time.
Reflected cross-site scripting in the Backwp WordPress plugin up to version 2.0.2 allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser when a malicious link is clicked. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and an EPSS score of 0.04%, indicating a low probability of widespread exploitation. No public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting (XSS) in the Photo Express for Google WordPress plugin up to version 0.3.2 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. Successful exploitation could lead to cookie theft, session hijacking, or defacement, but requires user interaction to click a crafted link. No active exploitation or public exploit code has been identified.
Stored cross-site scripting (XSS) in FasterThemes FastBook WordPress plugin through version 1.1 allows unauthenticated attackers to inject malicious scripts via web page input. When an administrator or other site user views the affected page, the script executes in their browser, potentially leading to session hijacking or credential theft. No active exploitation or public PoC is known, and EPSS estimates a very low exploitation probability (0.04%).
Reflected cross-site scripting (XSS) in the WPCRM WordPress plugin <= 3.2.0 allows unauthenticated attackers to inject arbitrary web scripts via crafted parameters. An attacker can trick a victim into clicking a malicious link, leading to session theft or defacement. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in the SpecFit Virtual Try-On Woocommerce plugin for WordPress allows unauthenticated attackers to inject malicious scripts into pages that are later viewed by other users, potentially leading to session hijacking, data theft, or site defacement. The vulnerability affects versions up to 7.0.6; no active exploitation or public exploit is known at the time of analysis, and the EPSS score is low (0.04%).
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored Cross-Site Scripting in the Osom Blocks WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the class_name parameter, executing whenever a user views the compromised page. The vulnerability affects all versions up to 1.2.1 and carries a CVSS score of 6.4 (Medium) with an EPSS probability of 0.04%, indicating low exploitation likelihood. No active exploitation (KEV) or public exploit code has been identified at this time.
The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms that allow an attacker to store on database and then inject HTML and/or Javascript on the page. The solution is to upgrade to Horizon 33.1.6, 33.1.7 or Meridian 2024.2.6, 2024.2.7 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Fábio Tomé for reporting this issue.
Cross-site scripting in xuxueli xxl-sso 1.1.0 login page allows remote attackers to inject arbitrary web script via the errorMsg parameter. The vulnerability is publicly disclosed with exploit code available, but no active exploitation has been confirmed by CISA KEV. Successful exploitation could lead to session hijacking or defacement if an administrator or user interacts with a crafted link.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers with low privileges to inject scripts via employee registration form fields. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed. The vendor did not respond to disclosure, leaving the vulnerability unpatched.
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
Cross-site scripting in WeGIA 3.4.0 allows a remote authenticated low-privileged attacker to inject arbitrary web script via the 'Insira o novo tipo' parameter in the adicionar_tipoSaida.php page. Successful exploitation requires user interaction and can lead to session hijacking or unauthorized actions on behalf of the victim. Public exploit code exists but no active widespread exploitation has been reported.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira o novo tipo' parameter in /html/matPat/adicionar_tipoEntrada.php. The vulnerability requires an authenticated user to click a malicious link, but exploit code is publicly available. No active exploitation has been confirmed.
Cross-site scripting in LabRedesCefetRJ WeGIA 3.4.0 allows remote authenticated attackers with user interaction to inject arbitrary web script via the Nome/Sobrenome fields. The vulnerability has a publicly available proof-of-concept but no confirmed active exploitation; EPSS indicates low exploitation probability.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. The plugin is disabled by default.
Cross-site scripting in code-projects Simple Forum 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the /forum_edit1.php text parameter. The attack can be carried out by an authenticated user and executes when another user views the manipulated page. Public exploit code is available, but EPSS data indicates very low exploitation probability.
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP VR - 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Stored cross-site scripting (XSS) in code-projects Food Distributor Site 1.0 allows an authenticated administrator to inject arbitrary JavaScript into site settings. The vulnerability is triggered via the site_phone, site_email, or address parameters in the /admin/save_settings.php endpoint. Public exploit code is available, but the high privilege requirement (administrator access) and low EPSS score (0.07%) limit real-world risk.
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.
A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. The name field fails to properly sanitize user input, allowing an attacker to inject malicious JavaScript.
IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Stored XSS via cross-site request forgery in the re.place WordPress plugin allows an attacker to store malicious scripts by tricking a logged-in administrator into clicking a crafted link. The vulnerability affects versions up to 0.2.1, and no active exploitation or public exploit code has been identified at the time of analysis.
Stored XSS in the My Resume Builder WordPress plugin (versions through 1.0.3) enables authenticated contributors to inject persistent JavaScript payloads into resume content that executes in the browsers of other users who view it. When a privileged user such as an administrator views the affected page, the injected script runs in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the EPSS score of 0.04% indicates negligible observed exploitation interest.
Stored Cross-Site Scripting (XSS) in the RSS Digest WordPress plugin (versions up to 1.5) can be exploited via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to trick site administrators into performing actions that inject malicious scripts. The injected payload persists and executes in the browsers of other users, leading to content manipulation, session theft, or site defacement. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability.
Cross-site request forgery in the Społecznościowa 6 PL 2013 WordPress plugin (versions <= 2.0.6) allows unauthenticated attackers to trick an administrator into executing unintended actions, leading to stored cross-site scripting. This enables injection of malicious scripts that execute in the browsers of other users, potentially stealing session cookies, defacing the site, or redirecting visitors. No active exploitation is confirmed, and the EPSS score is very low (0.02%).
Stored cross-site scripting in the WordPress plugin Beauty Contact Popup Form up to version 6.0 enables authenticated attackers with high privileges to inject malicious scripts that execute when other users view stored contact form data. This issue has a medium CVSS score and low EPSS exploitation probability, with no known active exploitation or public exploit code.
DOM-based cross-site scripting in the WordPress Raise The Money plugin allows authenticated attackers with low privileges to inject malicious scripts, leading to code execution in victims' browsers. No active exploitation or public exploit code has been observed, and EPSS predicts a 0.04% chance of exploitation, indicating very low real-world risk.
Cross-site scripting in Free Downloads EDD WordPress plugin allows DOM-based XSS attacks against authenticated users with low privileges, potentially leading to session hijacking or malicious actions. The vulnerability affects versions up to 1.0.4 and has a low exploitation likelihood (EPSS 0.04%) with no public exploit or active exploitation reported.
Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.
Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.
Reflected XSS vulnerability in WordPress
Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.
Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full
DOM-Based Cross-Site Scripting in the Theme Junkie Team Content WordPress plugin (versions through 0.1.1) allows a low-privileged authenticated attacker to inject malicious scripts that execute in the browser of any user who views the affected page. Because the scope changes (S:C in the CVSS vector), the injected script can access session cookies and perform actions on behalf of higher-privileged users such as administrators. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.04% reflects very low observed exploitation probability.
Stored cross-site scripting in the WordPress Podcast Feed Player Widget and Shortcode plugin up to version 2.2.0 allows authenticated contributors to inject arbitrary JavaScript through shortcode or widget inputs. When an administrator views the affected page, the script executes in the admin's browser context, enabling session theft or actions on behalf of the admin. No evidence of active exploitation (CISA KEV not listed) and EPSS score is low (0.04%), reducing immediate priority.
Stored cross-site scripting in the EC Stars Rating WordPress plugin (versions ≤1.0.11) allows authenticated administrators to inject malicious scripts that execute in the browsers of other users who view the affected rating page. This could lead to session hijacking, defacement, or other browser-based attacks.
Stored cross-site scripting (XSS) in the Smart Agenda WordPress plugin up to version 4.9 allows authenticated attackers with low-privilege accounts to inject malicious scripts that execute in the browsers of users viewing the compromised content. No known public exploit or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.04% indicates a very low probability of exploitation in the wild.
DOM-based XSS in the WP DataTable WordPress plugin (versions up to and including 0.2.7) allows a low-privileged authenticated attacker to inject malicious client-side scripts that execute in a victim's browser session. The flaw is classified under CWE-79 and arises from insufficient input neutralization in a DOM manipulation path, meaning the payload is processed by the browser rather than the server. No public exploit code and no CISA KEV listing have been identified at the time of analysis; EPSS at 0.04% reflects a low near-term exploitation probability.
Stored cross-site scripting in the WordPress plugin WP Visual Sitemap up to version 1.0.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into sitemap content. When an administrator or other privileged user views the affected content, the script executes in their browser, enabling session hijacking or site defacement. No public exploit or active exploitation is known, and EPSS probability is very low (0.04%).
Stored cross-site scripting in the Quick Favicon WordPress plugin ≤0.22.8 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when another user views an affected page. No known public exploit or active exploitation has been reported, and EPSS indicates a very low probability of widespread use.
Stored cross-site scripting (XSS) in the Affiliate Links for Amazon WordPress plugin (versions up to 1.0.6) allows an authenticated attacker with high privileges to inject arbitrary scripts that execute when another user views the affected page. No public exploit or active exploitation has been identified, and the EPSS score indicates very low exploitation probability (0.04%).
Stored cross-site scripting in WordPress Thumbnail Editor plugin ≤2.3.3 allows authenticated users with low privileges to inject arbitrary web scripts that execute when an administrator views the affected content, potentially leading to privilege escalation or data theft. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.04%).
Stored cross-site scripting in the Football Pool WordPress plugin (≤2.12.5) enables authenticated attackers to inject malicious scripts into pages viewed by other users. Successful exploitation requires user interaction to trigger the stored payload, leading to potential data theft or session compromise. EPSS indicates very low current exploitation probability (0.04%).
DOM-Based Cross-Site Scripting (XSS) in the Popup addon for Ninja Forms WordPress plugin up to version 3.4 allows authenticated attackers with at least contributor-level access to inject and execute arbitrary JavaScript in the browser of a victim who interacts with a crafted popup. Successful exploitation could lead to session hijacking, credential theft, or complete site takeover in the context of a higher-privileged user. No active exploitation or public exploit code is known at this time, and the EPSS exploitation probability is low (0.04%).
Stored Cross-Site Scripting in WP AdCenter plugin up to version 2.6.0 allows authenticated users with low-level privileges to inject malicious scripts into ad content, which execute in the browsers of administrators viewing the affected pages, potentially leading to session hijacking or privilege escalation. No active exploitation or public exploit code has been identified, and the EPSS score indicates a very low probability of widespread exploitation.
DOM-based Cross-Site Scripting (XSS) in the Omnipress WordPress plugin through version 1.6.3 allows authenticated attackers with low privileges (e.g., contributor accounts) to inject malicious scripts that execute in the browser of an administrator or other user. The vulnerability is triggered via crafted page content and requires victim interaction (e.g., visiting a page). No active exploitation or public proof-of-concept has been identified, and the EPSS score is very low (0.04%), indicating minimal current exploitation risk.
DOM-based cross-site scripting (XSS) vulnerability in the VaultDweller Leyka WordPress plugin (versions ≤3.31.9) allows authenticated attackers to inject arbitrary JavaScript into pages viewed by other users. Successful exploitation requires a low-privileged attacker account and user interaction, potentially leading to session hijacking or page manipulation. No active exploitation or public exploit code has been confirmed at this time.
Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.
Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) in the Additional Order Filters for WooCommerce WordPress plugin up to version 1.22 allows unauthenticated attackers to inject malicious scripts that execute in the context of an admin user. Exploitation requires tricking a logged-in administrator into clicking a crafted link, resulting in script storage that can compromise other admins' sessions and site data. The vulnerability has a CVSS base score of 7.1 but an extremely low EPSS exploitation probability (0.02%), and no active exploitation or public exploit code has been identified.
Stored cross-site scripting (XSS) in the WP Edit WordPress plugin through version 4.0.4 allows authenticated attackers with high privileges (such as administrators) to inject arbitrary web scripts into pages. These scripts execute in the browsers of other users who later view the affected content, enabling session hijacking, defacement, or theft of sensitive data. No public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low current exploitation probability.
Stored cross-site scripting in HT Mega – Absolute Addons for WPBakery Page Builder allows authenticated attackers with low privileges to inject arbitrary web scripts. When an administrator or other high-privilege user views the injected content, the script executes in their browser, leading to session theft, account takeover, or site defacement. The vulnerability affects all versions up to 1.0.8; no active exploitation or public exploit code is known, and the EPSS probability is low.
DOM-based cross-site scripting in the CyberChimps Responsive Blocks WordPress plugin allows authenticated attackers to inject arbitrary JavaScript. The vulnerability affects plugin versions up to 2.0.6 and can be exploited by low-privileged users who create malicious block content, leading to script execution in the browsers of victims who view the affected page. No active exploitation or public exploit code has been identified at this time.
A DOM-based cross-site scripting (XSS) vulnerability in the HT Slider For Elementor WordPress plugin up to version 1.
Reflected cross-site scripting in the LMS WordPress theme by designthemes allows unauthenticated attackers to execute arbitrary scripts in a victim's browser via a crafted link, affecting all versions up to 9.1. User interaction is required, enabling session hijacking or data theft. No public exploit code or active exploitation has been identified, and EPSS predicts very low exploitation likelihood.
Reflected Cross-Site Scripting in the xili-dictionary WordPress plugin through version 2.12.5.2 allows attackers to execute arbitrary scripts in a victim's browser. A remote attacker can craft a malicious link that, when clicked by a user visiting an affected site, can steal cookies, redirect browsers, or deface content. No active exploitation or public exploit is currently known, and EPSS indicates a low probability of widespread exploitation.
Reflected cross-site scripting in the Infility Global WordPress plugin (≤2.12.7) allows unauthenticated remote attackers to execute arbitrary script in a victim's browser via a crafted link. No public exploit or active exploitation has been identified; the EPSS score is 0.04%, indicating low exploitation probability despite a CVSS 3.1 score of 7.1.
Reflected Cross-Site Scripting in the CSS3 Vertical Web Pricing Tables WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Version 1.9 and earlier are affected, and exploitation requires a victim to click a crafted link. No active exploitation or public exploit code has been reported, and the EPSS score of 0.04% indicates a very low probability of real-world attacks.
Unauthenticated remote attackers can inject arbitrary web scripts via a crafted URL due to improper input sanitization in the Flexo Counter WordPress plugin through version 1.0001. When a victim clicks the link, malicious JavaScript executes in their browser, potentially leading to session theft or defacement. No active exploitation or public exploit is confirmed, and EPSS indicates very low exploitation probability (0.04%, 13th percentile).
Reflected cross-site scripting in the Bulk YouTube Post Creator WordPress plugin up to version 1.0 allows unauthenticated attackers to inject malicious scripts by tricking an authenticated user into clicking a crafted link. An attacker could hijack the victim's session, steal sensitive data, or perform actions on the victim's behalf within the context of the affected site. EPSS indicates very low exploitation probability (0.04%), and no active exploitation has been confirmed.
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Reflected cross-site scripting in the Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin up to version 0.5.8.4 allows unauthenticated attackers to inject arbitrary web scripts via crafted requests. Successful exploitation requires a victim to click a malicious link, leading to script execution in the victim's browser, which may steal session cookies or deface pages. No evidence of active exploitation or public exploit code exists at this time.
Reflected cross-site scripting (XSS) in the WordPress plugin FormLift for Infusionsoft Web Forms (versions up to 7.5.20) allows remote unauthenticated attackers to inject arbitrary web scripts via user-supplied input. Exploitation requires a victim to click a malicious link, but can lead to session theft, phishing, and other browser-based attacks. The vulnerability carries a CVSS score of 7.1, though EPSS indicates a very low (0.04%) probability of exploitation; no active exploitation or public exploit code has been identified.
Reflected Cross-Site Scripting (XSS) in the mojoomla School Management WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts via unsanitized input, exploiting victims who click a crafted link. This vulnerability affects plugin versions through 92.0.0, with no known public exploit or active exploitation reported at the time of analysis.
Reflected cross-site scripting in the Sneeit MagOne WordPress theme up to version 8.5 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a specially crafted link. This can lead to session hijacking, data theft, or site defacement. No public exploit or active exploitation has been reported, and the EPSS probability is very low at 0.04%.
Reflected cross-site scripting in the Smart Notification WordPress plugin up to version 10.3 enables unauthenticated attackers to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link. This can lead to session hijacking, credential theft, or malicious actions on behalf of the victim. While no active exploitation or public exploit code is currently reported, the low CVSS impact and very low EPSS score suggest limited real-world risk at this time.
Reflected cross-site scripting in the HYDRO WordPress theme (versions ≤2.8) allows unauthenticated attackers to inject arbitrary web scripts after a victim clicks a crafted link, enabling session hijacking or unauthorized actions in the victim's browser. No public exploit code or active exploitation was identified at time of analysis, and EPSS predicts very low exploitation probability (0.04%).
Stored cross-site scripting in the Seven Stars WordPress theme by themeton allows unauthenticated attackers to inject malicious scripts into the site that execute when other users-such as admins-view the affected page. The vulnerability affects versions 1.4.4 and earlier, and while no active exploitation has been confirmed, publicly available proof-of-concept exploits likely exist given the nature of stored XSS. CVSS 7.1 indicates high severity, but EPSS estimates only a 0.04% probability of exploitation.
Stored cross-site scripting in Woocommerce Line Notify plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts that execute when a victim views an affected page, potentially leading to session hijacking or unauthorized actions. All versions up to 1.1.7 are vulnerable; no active exploitation or public proof-of-concept has been confirmed despite a High CVSS score of 7.1. The EPSS score of 0.04% indicates extremely low likelihood of real-world exploitation at this time.
Reflected cross-site scripting (XSS) in the WP Front User Submit / Front Editor WordPress plugin versions up to 4.9.3 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. The attack requires user interaction (e.g., clicking a link) and can lead to script execution in the victim’s browser, potentially enabling data theft or defacement. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread exploitation.
Reflected cross-site scripting in the Evangelische Termine WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a malicious link. Versions up to and including 3.3 are affected. Exploitation requires user interaction, and no active exploitation or public proof-of-concept has been identified at this time.
Reflected cross-site scripting in the Backwp WordPress plugin up to version 2.0.2 allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser when a malicious link is clicked. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and an EPSS score of 0.04%, indicating a low probability of widespread exploitation. No public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting (XSS) in the Photo Express for Google WordPress plugin up to version 0.3.2 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. Successful exploitation could lead to cookie theft, session hijacking, or defacement, but requires user interaction to click a crafted link. No active exploitation or public exploit code has been identified.
Stored cross-site scripting (XSS) in FasterThemes FastBook WordPress plugin through version 1.1 allows unauthenticated attackers to inject malicious scripts via web page input. When an administrator or other site user views the affected page, the script executes in their browser, potentially leading to session hijacking or credential theft. No active exploitation or public PoC is known, and EPSS estimates a very low exploitation probability (0.04%).
Reflected cross-site scripting (XSS) in the WPCRM WordPress plugin <= 3.2.0 allows unauthenticated attackers to inject arbitrary web scripts via crafted parameters. An attacker can trick a victim into clicking a malicious link, leading to session theft or defacement. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in the SpecFit Virtual Try-On Woocommerce plugin for WordPress allows unauthenticated attackers to inject malicious scripts into pages that are later viewed by other users, potentially leading to session hijacking, data theft, or site defacement. The vulnerability affects versions up to 7.0.6; no active exploitation or public exploit is known at the time of analysis, and the EPSS score is low (0.04%).
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored Cross-Site Scripting in the Osom Blocks WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the class_name parameter, executing whenever a user views the compromised page. The vulnerability affects all versions up to 1.2.1 and carries a CVSS score of 6.4 (Medium) with an EPSS probability of 0.04%, indicating low exploitation likelihood. No active exploitation (KEV) or public exploit code has been identified at this time.
The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms that allow an attacker to store on database and then inject HTML and/or Javascript on the page. The solution is to upgrade to Horizon 33.1.6, 33.1.7 or Meridian 2024.2.6, 2024.2.7 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Fábio Tomé for reporting this issue.
Cross-site scripting in xuxueli xxl-sso 1.1.0 login page allows remote attackers to inject arbitrary web script via the errorMsg parameter. The vulnerability is publicly disclosed with exploit code available, but no active exploitation has been confirmed by CISA KEV. Successful exploitation could lead to session hijacking or defacement if an administrator or user interacts with a crafted link.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers with low privileges to inject scripts via employee registration form fields. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed. The vendor did not respond to disclosure, leaving the vulnerability unpatched.
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
Cross-site scripting in WeGIA 3.4.0 allows a remote authenticated low-privileged attacker to inject arbitrary web script via the 'Insira o novo tipo' parameter in the adicionar_tipoSaida.php page. Successful exploitation requires user interaction and can lead to session hijacking or unauthorized actions on behalf of the victim. Public exploit code exists but no active widespread exploitation has been reported.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira o novo tipo' parameter in /html/matPat/adicionar_tipoEntrada.php. The vulnerability requires an authenticated user to click a malicious link, but exploit code is publicly available. No active exploitation has been confirmed.
Cross-site scripting in LabRedesCefetRJ WeGIA 3.4.0 allows remote authenticated attackers with user interaction to inject arbitrary web script via the Nome/Sobrenome fields. The vulnerability has a publicly available proof-of-concept but no confirmed active exploitation; EPSS indicates low exploitation probability.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.