XSS
Monthly
Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft's Konami Easter Egg browser extension (versions through v0.4) that can lead to Stored Cross-Site Scripting (XSS) attacks. An attacker can craft a malicious request to inject persistent JavaScript code that executes in the context of affected users' browsers, potentially compromising user sessions, stealing credentials, or performing unauthorized actions. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to users of the extension, though real-world exploitation likelihood depends on whether public exploits exist and the extension's actual user base.
Stored cross-site scripting in the Simple Membership WordPress plugin ≤4.6.3 allows authenticated administrators to inject malicious scripts that execute when another user views a crafted page. The attack requires high privileges and user interaction; no active exploitation or public exploit code is known. Impact is limited to low confidentiality and integrity compromise on the victim's browser session.
Stored cross-site scripting (XSS) vulnerability in SeedProd's 404 Page plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Affected versions prior to 1.0.2 are vulnerable; a patch is available. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in WPtouch 4.3.60 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in BRW WordPress plugin up to version 1.8.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in The Events Calendar Countdown Addon for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into event countdown displays. Affects versions up to 1.4.9. No public exploit or active exploitation identified.
Stored cross-site scripting in the Frontend Dashboard WordPress plugin (≤2.2.8) allows authenticated attackers with low privileges to inject malicious scripts into dashboard fields, which execute in the browsers of other users—including administrators—who view the affected content. Exploitation requires an attacker to have at least a Subscriber-level account and user interaction from a victim; no active exploitation or public exploit code is known.
Stored cross-site scripting in HT Team Member WordPress plugin up to version 1.1.7 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting (XSS) in WP Social Widget through version 2.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Product Catalog Simple WordPress plugin up to version 1.8.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into product catalog pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting in Search with Typesense WordPress plugin up to version 2.0.10 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
DOM-based cross-site scripting in the Greenshift WordPress plugin allows authenticated attackers with low privileges to execute arbitrary JavaScript in victims' browsers. The vulnerability affects all versions up to and including 11.5.5. No public exploit or active exploitation has been identified at this time, and the EPSS score of 0.05% indicates a low probability of widespread exploitation.
Stored cross-site scripting in WebHotelier WordPress plugin up to version 1.9.2 allows authenticated attackers with contributor-level access to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Event post WordPress plugin through version 5.10.1 allows authenticated attackers to inject arbitrary web scripts via unsanitized post fields, which execute when an administrator views the crafted content. This vulnerability carries a medium CVSS base score of 6.5, with low EPSS exploitation probability and no evidence of active exploitation. User interaction and authentication are required, limiting widespread impact.
Stored Cross-Site Scripting (XSS) vulnerability in the Sina Extension for Elementor WordPress plugin (versions up to 3.6.1) that allows authenticated attackers with high privileges to inject malicious scripts into web pages. When victims view the affected pages, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or defacement. While the CVSS score of 7.6 indicates moderate-to-high severity, the requirement for high-privilege authentication (PR:H) significantly limits exploitation scope compared to unauthenticated XSS vulnerabilities.
Stored cross-site scripting (XSS) vulnerability in the Shortcodes Ultimate WordPress plugin versions up to 7.3.5 allows authenticated attackers to inject arbitrary web scripts that execute when an administrator or other user views a page containing the malicious shortcode. This could lead to session hijacking, credential theft, or site defacement. No active exploitation has been reported, and the EPSS score is very low (0.05%), indicating limited real-world risk.
Stored cross-site scripting in ShiftNav - Responsive Mobile Menu plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. The vulnerability affects all versions up to and including 1.8, and no public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in the Bellows Accordion Menu WordPress plugin allows authenticated attackers with contributor-level or higher permissions to inject malicious scripts into accordion items. When other users view the affected pages, the scripts execute in their browsers, potentially leading to session hijacking, account takeover, or content manipulation. No active exploitation or public exploit has been identified; the EPSS score of 0.05% indicates low exploitation probability.
Stored cross-site scripting (XSS) in RTMKit Addons for Elementor through version 1.6.0 allows authenticated attackers with contributor-level privileges to inject arbitrary JavaScript into pages. When an administrator views the compromised page, the script executes with their session, enabling data theft or further actions. No active exploitation or public proof-of-concept has been identified; EPSS score is low at 0.05%.
Stored cross-site scripting in Image Hover Effects Block for WordPress up to version 1.4.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light plugin (versions up to 3.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to trick authenticated users into performing unintended actions, resulting in persistent XSS payload injection that affects all subsequent visitors. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world exploitability without requiring elevated privileges.
Stored cross-site scripting in the Premium Packages plugin for WordPress allows authenticated attackers with low privileges to inject scripts that execute in other users' browsers when they view the malicious content. Versions up to 6.0.2 are affected, and no public exploit or active exploitation has been reported; EPSS estimates a 0.05% chance of exploitation.
Stored cross-site scripting in Chaport WordPress plugin up to version 1.1.5 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in wpdive Nexa Blocks up to version 1.1.0 enables authenticated attackers with low privileges to inject malicious scripts into pages, leading to arbitrary script execution in the browsers of users who view the contaminated content. This can result in session hijacking, phishing, or site defacement. No active exploitation or public exploit has been identified; EPSS indicates low exploitation probability.
Stored cross-site scripting in BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in All Currencies for WooCommerce plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting in Post Custom Templates Lite allows authenticated high-privilege attackers to inject scripts that execute in other users' browsers. Affected versions up to 1.14. No active exploitation or public exploit code identified; EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in Pinterest Verify Meta Tag WordPress plugin up to version 1.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Stored cross-site scripting in the Melipayamak WordPress plugin version 2.2.12 and earlier allows high-privilege authenticated users to inject malicious scripts that execute in other users' browsers, potentially hijacking sessions or redirecting to malicious sites. Exploitation requires user interaction; no active exploitation or public proof-of-concept has been observed, and EPSS indicates very low exploitation probability.
Cross-site scripting in the IFrame Widget WordPress plugin allows stored script injection by authenticated high-privilege users. Affected versions up to 4.1 enable attackers to execute arbitrary JavaScript in the browsers of visitors, potentially compromising user sessions or site integrity. No active exploitation or public exploit code is confirmed, and EPSS predicts low exploitation likelihood.
Stored cross-site scripting (XSS) in Broadly for WordPress plugin up to version 3.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored Cross-Site Scripting (XSS) in the Responsify WP WordPress plugin version 1.9.11 and earlier allows authenticated attackers with high privileges to inject arbitrary web scripts into pages viewed by other users. The injected code executes in the victim’s browser when they access an affected page, potentially leading to session hijacking, content manipulation, or other client-side attacks. No public exploit code or active exploitation has been reported at this time.
DOM-based cross-site scripting in NickDuncan Contact Form plugin for WordPress ≤2.0.12 allows authenticated low-privilege users to inject arbitrary web scripts. When a higher-privilege user interacts with the malicious content, the script executes in their browser, potentially compromising the session. EPSS indicates very low exploitation likelihood (0.05%), and no active exploitation or public PoC is currently known.
Stored cross-site scripting in the WordPress plugin «Подсказки» от DaData.ru up to version 1.0.6 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in ACF: Yandex Maps Field plugin for WordPress up to version 1.1 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Biographia 4.0.0 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Powie's Uptime Robot WordPress plugin up to version 0.9.7 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Deetronix Booking Ultra Pro WordPress plugin 1.1.20 and earlier allows authenticated high-privilege attackers to inject arbitrary web scripts. Users who view affected plugin pages can trigger execution, leading to session hijacking or malicious actions in their browser context. No active exploitation or public exploit code has been identified, and EPSS indicates a very low exploitation probability (0.04%, 13th percentile).
Stored cross-site scripting in WP Featured Content Slider 2.6 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view the slider. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Global Translator WordPress plugin up to version 2.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Stored cross-site scripting in Elegant Visitor Counter plugin for WordPress up to version 3.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in AppBanners WordPress plugin up to version 1.5.14 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in YouTube Simple Gallery WordPress plugin up to version 2.2.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in The Holiday Calendar WordPress plugin up to version 1.18.2.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in the Read More Login WordPress plugin (≤2.0.3) allows high-privileged attackers to inject scripts executed by other users. Exploitation requires administrator access and user interaction, and no public exploit or active exploitation has been identified. The vulnerability poses limited risk due to required privileges and very low exploitation probability (EPSS 0.04%).
A cross-site scripting vulnerability in Soli WP Mail Options allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CSRF vulnerability in mail250 Free WP Mail SMTP (versions up to 1.0) that enables stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts via crafted requests. The vulnerability requires user interaction (UI:R) but has network-based attack vector (AV:N) with low complexity (AC:L), affecting WordPress installations using this email plugin. While CVSS 7.1 indicates medium-high severity with confidentiality, integrity, and availability impact, real-world exploitation depends on KEV status, EPSS probability, and public POC availability-data not provided in the source material.
Cross-Site Request Forgery (CSRF) vulnerability in the dilemma123 Recent Posts Slider Responsive WordPress plugin (versions through 1.0.1) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads, which execute in the browsers of site administrators and visitors, potentially leading to account compromise, malware distribution, or defacement. The vulnerability requires user interaction (UI:R) but has network-accessible attack surface (AV:N) with moderate CVSS score of 7.1 and should be prioritized for patched WordPress installations running vulnerable plugin versions.
Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon (versions up to 2.0) that enables Stored XSS attacks. An unauthenticated attacker can craft a malicious request that, when visited by a user, executes arbitrary JavaScript in the victim's browser context with access to sensitive data and session tokens. While no public exploit or KEV status confirmation is available from the provided data, the CVSS 7.1 score and Stored XSS payload persistence indicate moderate-to-high real-world risk, particularly if the plugin has significant user adoption.
Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov's Bg Orthodox Calendar plugin that enables Stored Cross-Site Scripting (XSS) attacks. The vulnerability affects all versions from an unspecified baseline through 0.13.10, allowing unauthenticated attackers over the network to inject and store malicious scripts that execute in users' browsers with moderate impact to confidentiality, integrity, and availability. The CVSS 7.1 score reflects the combination of network attack vector with user interaction requirement; real-world exploitation risk depends on whether this vulnerability is actively exploited or has public proof-of-concept code available.
Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai's Post Author WordPress plugin (versions through 1.1.1) that enables Stored Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in the browsers of all users viewing affected content, potentially leading to account compromise, data theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating practical exploitability without authentication.
Cross-Site Request Forgery (CSRF) vulnerability in the codedraft Mediabay WordPress plugin (versions up to 1.4) that enables reflected XSS attacks. Attackers can exploit this network-accessible vulnerability without authentication to perform unauthorized actions on behalf of authenticated users and inject malicious scripts, affecting WordPress installations using this media library plugin. The CVSS 7.1 score and absence of KEV/active exploitation data suggest moderate real-world risk with UI interaction required.
DOM-Based Cross-Site Scripting (XSS) in Simple Google Static Map plugin for WordPress versions up to 1.0.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.
The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in The Plus Addons for Elementor Page Builder Lite up to version 6.2.7 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in PickPlugins Wishlist plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into wishlist pages. Affects versions through 1.0.43. No public exploit or active exploitation identified.
Stored cross-site scripting in WidgetKit for Elementor allows authenticated attackers with contributor-level access to inject malicious scripts via widget settings. The vulnerability affects all versions up to 2.5.4 and can lead to session hijacking or defacement when an admin views the compromised page. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Ocean Extra WordPress plugin up to version 2.4.8 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in Nasa Core WordPress plugin before 6.4.1 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified, and EPSS score is low (0.05%).
A reflected cross-site scripting (XSS) vulnerability exists in Daman Jeet's Real Time Validation for Gravity Forms plugin affecting versions through 1.7.0, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise user sessions, steal credentials, or deface form content due to its cross-site impact scope. While the CVSS score of 7.1 indicates moderate-to-high severity, real-world exploitation depends on form visibility and user interaction patterns.
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
Stored cross-site scripting in code-projects Traffic Offense Reporting System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via multiple parameters in /save-reported.php. Public exploit code exists, but EPSS score is low (0.05%) and no active exploitation has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Title field on the Announcement page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Runners Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The BNS Featured Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Freemind Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'freemind' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Division parameter on the Division System page. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated user with high privileges to inject arbitrary JavaScript via the Remark field on the Grading System page. The exploit is publicly available, but EPSS score is low (0.06%) and no active exploitation has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Subject field on the Subjects page. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Class Name field on the Classes page. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported and the EPSS score is low (0.09%).
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Academic Term field in the Add Academic Term page. The vulnerability is publicly exploited with a proof-of-concept available, though EPSS score is low (0.09%) and no active exploitation in CISA KEV has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated high-privilege user to inject malicious scripts via the email field on the profile update page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
Stored cross-site scripting in iSoluçõesWEB up to 20250519 allows an authenticated attacker with low privileges to inject malicious scripts via the 'Descrição da solicitação' parameter in the /fluxos-dashboard endpoint. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.06%).
A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part of the file /save-settings.php of the component Setting Handler. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.
A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affects some unknown processing of the file saveuser.php. The manipulation of the argument user_id/username/email/name/position leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as problematic, has been found in SourceCodester Food Menu Manager 1.0. Affected by this issue is some unknown functionality of the file /index.php of the component Add Menu Handler. The manipulation of the argument name/description leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the `<iframe srcdoc>` attribute, which leads to cross-site scripting (XSS) by loading an attacker's UserJS inside `<script src>`. In order to execute the attack, the attacker needs to control one of the victim's feeds and have an account on the FreshRSS instance that the victim is using. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 contains a patch for the issue.
Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft's Konami Easter Egg browser extension (versions through v0.4) that can lead to Stored Cross-Site Scripting (XSS) attacks. An attacker can craft a malicious request to inject persistent JavaScript code that executes in the context of affected users' browsers, potentially compromising user sessions, stealing credentials, or performing unauthorized actions. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to users of the extension, though real-world exploitation likelihood depends on whether public exploits exist and the extension's actual user base.
Stored cross-site scripting in the Simple Membership WordPress plugin ≤4.6.3 allows authenticated administrators to inject malicious scripts that execute when another user views a crafted page. The attack requires high privileges and user interaction; no active exploitation or public exploit code is known. Impact is limited to low confidentiality and integrity compromise on the victim's browser session.
Stored cross-site scripting (XSS) vulnerability in SeedProd's 404 Page plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Affected versions prior to 1.0.2 are vulnerable; a patch is available. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in WPtouch 4.3.60 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in BRW WordPress plugin up to version 1.8.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in The Events Calendar Countdown Addon for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into event countdown displays. Affects versions up to 1.4.9. No public exploit or active exploitation identified.
Stored cross-site scripting in the Frontend Dashboard WordPress plugin (≤2.2.8) allows authenticated attackers with low privileges to inject malicious scripts into dashboard fields, which execute in the browsers of other users—including administrators—who view the affected content. Exploitation requires an attacker to have at least a Subscriber-level account and user interaction from a victim; no active exploitation or public exploit code is known.
Stored cross-site scripting in HT Team Member WordPress plugin up to version 1.1.7 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting (XSS) in WP Social Widget through version 2.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Product Catalog Simple WordPress plugin up to version 1.8.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into product catalog pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting in Search with Typesense WordPress plugin up to version 2.0.10 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
DOM-based cross-site scripting in the Greenshift WordPress plugin allows authenticated attackers with low privileges to execute arbitrary JavaScript in victims' browsers. The vulnerability affects all versions up to and including 11.5.5. No public exploit or active exploitation has been identified at this time, and the EPSS score of 0.05% indicates a low probability of widespread exploitation.
Stored cross-site scripting in WebHotelier WordPress plugin up to version 1.9.2 allows authenticated attackers with contributor-level access to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Event post WordPress plugin through version 5.10.1 allows authenticated attackers to inject arbitrary web scripts via unsanitized post fields, which execute when an administrator views the crafted content. This vulnerability carries a medium CVSS base score of 6.5, with low EPSS exploitation probability and no evidence of active exploitation. User interaction and authentication are required, limiting widespread impact.
Stored Cross-Site Scripting (XSS) vulnerability in the Sina Extension for Elementor WordPress plugin (versions up to 3.6.1) that allows authenticated attackers with high privileges to inject malicious scripts into web pages. When victims view the affected pages, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or defacement. While the CVSS score of 7.6 indicates moderate-to-high severity, the requirement for high-privilege authentication (PR:H) significantly limits exploitation scope compared to unauthenticated XSS vulnerabilities.
Stored cross-site scripting (XSS) vulnerability in the Shortcodes Ultimate WordPress plugin versions up to 7.3.5 allows authenticated attackers to inject arbitrary web scripts that execute when an administrator or other user views a page containing the malicious shortcode. This could lead to session hijacking, credential theft, or site defacement. No active exploitation has been reported, and the EPSS score is very low (0.05%), indicating limited real-world risk.
Stored cross-site scripting in ShiftNav - Responsive Mobile Menu plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. The vulnerability affects all versions up to and including 1.8, and no public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in the Bellows Accordion Menu WordPress plugin allows authenticated attackers with contributor-level or higher permissions to inject malicious scripts into accordion items. When other users view the affected pages, the scripts execute in their browsers, potentially leading to session hijacking, account takeover, or content manipulation. No active exploitation or public exploit has been identified; the EPSS score of 0.05% indicates low exploitation probability.
Stored cross-site scripting (XSS) in RTMKit Addons for Elementor through version 1.6.0 allows authenticated attackers with contributor-level privileges to inject arbitrary JavaScript into pages. When an administrator views the compromised page, the script executes with their session, enabling data theft or further actions. No active exploitation or public proof-of-concept has been identified; EPSS score is low at 0.05%.
Stored cross-site scripting in Image Hover Effects Block for WordPress up to version 1.4.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light plugin (versions up to 3.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to trick authenticated users into performing unintended actions, resulting in persistent XSS payload injection that affects all subsequent visitors. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world exploitability without requiring elevated privileges.
Stored cross-site scripting in the Premium Packages plugin for WordPress allows authenticated attackers with low privileges to inject scripts that execute in other users' browsers when they view the malicious content. Versions up to 6.0.2 are affected, and no public exploit or active exploitation has been reported; EPSS estimates a 0.05% chance of exploitation.
Stored cross-site scripting in Chaport WordPress plugin up to version 1.1.5 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in wpdive Nexa Blocks up to version 1.1.0 enables authenticated attackers with low privileges to inject malicious scripts into pages, leading to arbitrary script execution in the browsers of users who view the contaminated content. This can result in session hijacking, phishing, or site defacement. No active exploitation or public exploit has been identified; EPSS indicates low exploitation probability.
Stored cross-site scripting in BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in All Currencies for WooCommerce plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting in Post Custom Templates Lite allows authenticated high-privilege attackers to inject scripts that execute in other users' browsers. Affected versions up to 1.14. No active exploitation or public exploit code identified; EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in Pinterest Verify Meta Tag WordPress plugin up to version 1.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Stored cross-site scripting in the Melipayamak WordPress plugin version 2.2.12 and earlier allows high-privilege authenticated users to inject malicious scripts that execute in other users' browsers, potentially hijacking sessions or redirecting to malicious sites. Exploitation requires user interaction; no active exploitation or public proof-of-concept has been observed, and EPSS indicates very low exploitation probability.
Cross-site scripting in the IFrame Widget WordPress plugin allows stored script injection by authenticated high-privilege users. Affected versions up to 4.1 enable attackers to execute arbitrary JavaScript in the browsers of visitors, potentially compromising user sessions or site integrity. No active exploitation or public exploit code is confirmed, and EPSS predicts low exploitation likelihood.
Stored cross-site scripting (XSS) in Broadly for WordPress plugin up to version 3.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored Cross-Site Scripting (XSS) in the Responsify WP WordPress plugin version 1.9.11 and earlier allows authenticated attackers with high privileges to inject arbitrary web scripts into pages viewed by other users. The injected code executes in the victim’s browser when they access an affected page, potentially leading to session hijacking, content manipulation, or other client-side attacks. No public exploit code or active exploitation has been reported at this time.
DOM-based cross-site scripting in NickDuncan Contact Form plugin for WordPress ≤2.0.12 allows authenticated low-privilege users to inject arbitrary web scripts. When a higher-privilege user interacts with the malicious content, the script executes in their browser, potentially compromising the session. EPSS indicates very low exploitation likelihood (0.05%), and no active exploitation or public PoC is currently known.
Stored cross-site scripting in the WordPress plugin «Подсказки» от DaData.ru up to version 1.0.6 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in ACF: Yandex Maps Field plugin for WordPress up to version 1.1 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Biographia 4.0.0 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Powie's Uptime Robot WordPress plugin up to version 0.9.7 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Deetronix Booking Ultra Pro WordPress plugin 1.1.20 and earlier allows authenticated high-privilege attackers to inject arbitrary web scripts. Users who view affected plugin pages can trigger execution, leading to session hijacking or malicious actions in their browser context. No active exploitation or public exploit code has been identified, and EPSS indicates a very low exploitation probability (0.04%, 13th percentile).
Stored cross-site scripting in WP Featured Content Slider 2.6 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view the slider. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Global Translator WordPress plugin up to version 2.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Stored cross-site scripting in Elegant Visitor Counter plugin for WordPress up to version 3.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in AppBanners WordPress plugin up to version 1.5.14 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in YouTube Simple Gallery WordPress plugin up to version 2.2.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in The Holiday Calendar WordPress plugin up to version 1.18.2.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in the Read More Login WordPress plugin (≤2.0.3) allows high-privileged attackers to inject scripts executed by other users. Exploitation requires administrator access and user interaction, and no public exploit or active exploitation has been identified. The vulnerability poses limited risk due to required privileges and very low exploitation probability (EPSS 0.04%).
A cross-site scripting vulnerability in Soli WP Mail Options allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CSRF vulnerability in mail250 Free WP Mail SMTP (versions up to 1.0) that enables stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts via crafted requests. The vulnerability requires user interaction (UI:R) but has network-based attack vector (AV:N) with low complexity (AC:L), affecting WordPress installations using this email plugin. While CVSS 7.1 indicates medium-high severity with confidentiality, integrity, and availability impact, real-world exploitation depends on KEV status, EPSS probability, and public POC availability-data not provided in the source material.
Cross-Site Request Forgery (CSRF) vulnerability in the dilemma123 Recent Posts Slider Responsive WordPress plugin (versions through 1.0.1) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads, which execute in the browsers of site administrators and visitors, potentially leading to account compromise, malware distribution, or defacement. The vulnerability requires user interaction (UI:R) but has network-accessible attack surface (AV:N) with moderate CVSS score of 7.1 and should be prioritized for patched WordPress installations running vulnerable plugin versions.
Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon (versions up to 2.0) that enables Stored XSS attacks. An unauthenticated attacker can craft a malicious request that, when visited by a user, executes arbitrary JavaScript in the victim's browser context with access to sensitive data and session tokens. While no public exploit or KEV status confirmation is available from the provided data, the CVSS 7.1 score and Stored XSS payload persistence indicate moderate-to-high real-world risk, particularly if the plugin has significant user adoption.
Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov's Bg Orthodox Calendar plugin that enables Stored Cross-Site Scripting (XSS) attacks. The vulnerability affects all versions from an unspecified baseline through 0.13.10, allowing unauthenticated attackers over the network to inject and store malicious scripts that execute in users' browsers with moderate impact to confidentiality, integrity, and availability. The CVSS 7.1 score reflects the combination of network attack vector with user interaction requirement; real-world exploitation risk depends on whether this vulnerability is actively exploited or has public proof-of-concept code available.
Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai's Post Author WordPress plugin (versions through 1.1.1) that enables Stored Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in the browsers of all users viewing affected content, potentially leading to account compromise, data theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating practical exploitability without authentication.
Cross-Site Request Forgery (CSRF) vulnerability in the codedraft Mediabay WordPress plugin (versions up to 1.4) that enables reflected XSS attacks. Attackers can exploit this network-accessible vulnerability without authentication to perform unauthorized actions on behalf of authenticated users and inject malicious scripts, affecting WordPress installations using this media library plugin. The CVSS 7.1 score and absence of KEV/active exploitation data suggest moderate real-world risk with UI interaction required.
DOM-Based Cross-Site Scripting (XSS) in Simple Google Static Map plugin for WordPress versions up to 1.0.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.
The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in The Plus Addons for Elementor Page Builder Lite up to version 6.2.7 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in PickPlugins Wishlist plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into wishlist pages. Affects versions through 1.0.43. No public exploit or active exploitation identified.
Stored cross-site scripting in WidgetKit for Elementor allows authenticated attackers with contributor-level access to inject malicious scripts via widget settings. The vulnerability affects all versions up to 2.5.4 and can lead to session hijacking or defacement when an admin views the compromised page. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Ocean Extra WordPress plugin up to version 2.4.8 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in Nasa Core WordPress plugin before 6.4.1 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified, and EPSS score is low (0.05%).
A reflected cross-site scripting (XSS) vulnerability exists in Daman Jeet's Real Time Validation for Gravity Forms plugin affecting versions through 1.7.0, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise user sessions, steal credentials, or deface form content due to its cross-site impact scope. While the CVSS score of 7.1 indicates moderate-to-high severity, real-world exploitation depends on form visibility and user interaction patterns.
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
Stored cross-site scripting in code-projects Traffic Offense Reporting System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via multiple parameters in /save-reported.php. Public exploit code exists, but EPSS score is low (0.05%) and no active exploitation has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Title field on the Announcement page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Runners Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The BNS Featured Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Freemind Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'freemind' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Division parameter on the Division System page. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated user with high privileges to inject arbitrary JavaScript via the Remark field on the Grading System page. The exploit is publicly available, but EPSS score is low (0.06%) and no active exploitation has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Subject field on the Subjects page. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Class Name field on the Classes page. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported and the EPSS score is low (0.09%).
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Academic Term field in the Add Academic Term page. The vulnerability is publicly exploited with a proof-of-concept available, though EPSS score is low (0.09%) and no active exploitation in CISA KEV has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated high-privilege user to inject malicious scripts via the email field on the profile update page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
Stored cross-site scripting in iSoluçõesWEB up to 20250519 allows an authenticated attacker with low privileges to inject malicious scripts via the 'Descrição da solicitação' parameter in the /fluxos-dashboard endpoint. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.06%).
A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part of the file /save-settings.php of the component Setting Handler. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.
A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affects some unknown processing of the file saveuser.php. The manipulation of the argument user_id/username/email/name/position leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as problematic, has been found in SourceCodester Food Menu Manager 1.0. Affected by this issue is some unknown functionality of the file /index.php of the component Add Menu Handler. The manipulation of the argument name/description leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the `<iframe srcdoc>` attribute, which leads to cross-site scripting (XSS) by loading an attacker's UserJS inside `<script src>`. In order to execute the attack, the attacker needs to control one of the victim's feeds and have an account on the FreshRSS instance that the victim is using. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 contains a patch for the issue.