Cross-Site Scripting

Cross-site scripting in Free Downloads EDD WordPress plugin allows DOM-based XSS attacks against authenticated users with low privileges, potentially leading to session hijacking or malicious actions. The vulnerability affects versions up to 1.0.4 and has a low exploitation likelihood (EPSS 0.04%) with no public exploit or active exploitation reported.

Stored Cross-Site

Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).

Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.

Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.

Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.

Reflected XSS vulnerability in WordPress

Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.

Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full

DOM-Based Cross-Site Scripting in the Theme Junkie Team Content WordPress plugin (versions through 0.1.1) allows a low-privileged authenticated attacker to inject malicious scripts that execute in the browser of any user who views the affected page. Because the scope changes (S:C in the CVSS vector), the injected script can access session cookies and perform actions on behalf of higher-privileged users such as administrators. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.04% reflects very low observed exploitation probability.

Stored cross-site scripting in the WordPress Podcast Feed Player Widget and Shortcode plugin up to version 2.2.0 allows authenticated contributors to inject arbitrary JavaScript through shortcode or widget inputs. When an administrator views the affected page, the script executes in the admin's browser context, enabling session theft or actions on behalf of the admin. No evidence of active exploitation (CISA KEV not listed) and EPSS score is low (0.04%), reducing immediate priority.

Stored cross-site scripting in the EC Stars Rating WordPress plugin (versions ≤1.0.11) allows authenticated administrators to inject malicious scripts that execute in the browsers of other users who view the affected rating page. This could lead to session hijacking, defacement, or other browser-based attacks.

Stored cross-site scripting (XSS) in the Smart Agenda WordPress plugin up to version 4.9 allows authenticated attackers with low-privilege accounts to inject malicious scripts that execute in the browsers of users viewing the compromised content. No known public exploit or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.04% indicates a very low probability of exploitation in the wild.

DOM-based XSS in the WP DataTable WordPress plugin (versions up to and including 0.2.7) allows a low-privileged authenticated attacker to inject malicious client-side scripts that execute in a victim's browser session. The flaw is classified under CWE-79 and arises from insufficient input neutralization in a DOM manipulation path, meaning the payload is processed by the browser rather than the server. No public exploit code and no CISA KEV listing have been identified at the time of analysis; EPSS at 0.04% reflects a low near-term exploitation probability.

Stored cross-site scripting in the WordPress plugin WP Visual Sitemap up to version 1.0.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into sitemap content. When an administrator or other privileged user views the affected content, the script executes in their browser, enabling session hijacking or site defacement. No public exploit or active exploitation is known, and EPSS probability is very low (0.04%).

Stored cross-site scripting in the Quick Favicon WordPress plugin ≤0.22.8 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when another user views an affected page. No known public exploit or active exploitation has been reported, and EPSS indicates a very low probability of widespread use.

Stored cross-site scripting (XSS) in the Affiliate Links for Amazon WordPress plugin (versions up to 1.0.6) allows an authenticated attacker with high privileges to inject arbitrary scripts that execute when another user views the affected page. No public exploit or active exploitation has been identified, and the EPSS score indicates very low exploitation probability (0.04%).

Stored cross-site scripting in WordPress Thumbnail Editor plugin ≤2.3.3 allows authenticated users with low privileges to inject arbitrary web scripts that execute when an administrator views the affected content, potentially leading to privilege escalation or data theft. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.04%).

Stored cross-site scripting in the Football Pool WordPress plugin (≤2.12.5) enables authenticated attackers to inject malicious scripts into pages viewed by other users. Successful exploitation requires user interaction to trigger the stored payload, leading to potential data theft or session compromise. EPSS indicates very low current exploitation probability (0.04%).

DOM-Based Cross-Site Scripting (XSS) in the Popup addon for Ninja Forms WordPress plugin up to version 3.4 allows authenticated attackers with at least contributor-level access to inject and execute arbitrary JavaScript in the browser of a victim who interacts with a crafted popup. Successful exploitation could lead to session hijacking, credential theft, or complete site takeover in the context of a higher-privileged user. No active exploitation or public exploit code is known at this time, and the EPSS exploitation probability is low (0.04%).

Stored Cross-Site Scripting in WP AdCenter plugin up to version 2.6.0 allows authenticated users with low-level privileges to inject malicious scripts into ad content, which execute in the browsers of administrators viewing the affected pages, potentially leading to session hijacking or privilege escalation. No active exploitation or public exploit code has been identified, and the EPSS score indicates a very low probability of widespread exploitation.

DOM-based Cross-Site Scripting (XSS) in the Omnipress WordPress plugin through version 1.6.3 allows authenticated attackers with low privileges (e.g., contributor accounts) to inject malicious scripts that execute in the browser of an administrator or other user. The vulnerability is triggered via crafted page content and requires victim interaction (e.g., visiting a page). No active exploitation or public proof-of-concept has been identified, and the EPSS score is very low (0.04%), indicating minimal current exploitation risk.

DOM-based cross-site scripting (XSS) vulnerability in the VaultDweller Leyka WordPress plugin (versions ≤3.31.9) allows authenticated attackers to inject arbitrary JavaScript into pages viewed by other users. Successful exploitation requires a low-privileged attacker account and user interaction, potentially leading to session hijacking or page manipulation. No active exploitation or public exploit code has been confirmed at this time.

Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.

Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) in the Additional Order Filters for WooCommerce WordPress plugin up to version 1.22 allows unauthenticated attackers to inject malicious scripts that execute in the context of an admin user. Exploitation requires tricking a logged-in administrator into clicking a crafted link, resulting in script storage that can compromise other admins' sessions and site data. The vulnerability has a CVSS base score of 7.1 but an extremely low EPSS exploitation probability (0.02%), and no active exploitation or public exploit code has been identified.

Stored cross-site scripting (XSS) in the WP Edit WordPress plugin through version 4.0.4 allows authenticated attackers with high privileges (such as administrators) to inject arbitrary web scripts into pages. These scripts execute in the browsers of other users who later view the affected content, enabling session hijacking, defacement, or theft of sensitive data. No public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low current exploitation probability.

Stored cross-site scripting in HT Mega – Absolute Addons for WPBakery Page Builder allows authenticated attackers with low privileges to inject arbitrary web scripts. When an administrator or other high-privilege user views the injected content, the script executes in their browser, leading to session theft, account takeover, or site defacement. The vulnerability affects all versions up to 1.0.8; no active exploitation or public exploit code is known, and the EPSS probability is low.

DOM-based cross-site scripting in the CyberChimps Responsive Blocks WordPress plugin allows authenticated attackers to inject arbitrary JavaScript. The vulnerability affects plugin versions up to 2.0.6 and can be exploited by low-privileged users who create malicious block content, leading to script execution in the browsers of victims who view the affected page. No active exploitation or public exploit code has been identified at this time.

A DOM-based cross-site scripting (XSS) vulnerability in the HT Slider For Elementor WordPress plugin up to version 1.

Reflected cross-site scripting in the LMS WordPress theme by designthemes allows unauthenticated attackers to execute arbitrary scripts in a victim's browser via a crafted link, affecting all versions up to 9.1. User interaction is required, enabling session hijacking or data theft. No public exploit code or active exploitation has been identified, and EPSS predicts very low exploitation likelihood.

Reflected Cross-Site Scripting in the xili-dictionary WordPress plugin through version 2.12.5.2 allows attackers to execute arbitrary scripts in a victim's browser. A remote attacker can craft a malicious link that, when clicked by a user visiting an affected site, can steal cookies, redirect browsers, or deface content. No active exploitation or public exploit is currently known, and EPSS indicates a low probability of widespread exploitation.

Reflected cross-site scripting in the Infility Global WordPress plugin (≤2.12.7) allows unauthenticated remote attackers to execute arbitrary script in a victim's browser via a crafted link. No public exploit or active exploitation has been identified; the EPSS score is 0.04%, indicating low exploitation probability despite a CVSS 3.1 score of 7.1.

Reflected Cross-Site Scripting in the CSS3 Vertical Web Pricing Tables WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Version 1.9 and earlier are affected, and exploitation requires a victim to click a crafted link. No active exploitation or public exploit code has been reported, and the EPSS score of 0.04% indicates a very low probability of real-world attacks.

Unauthenticated remote attackers can inject arbitrary web scripts via a crafted URL due to improper input sanitization in the Flexo Counter WordPress plugin through version 1.0001. When a victim clicks the link, malicious JavaScript executes in their browser, potentially leading to session theft or defacement. No active exploitation or public exploit is confirmed, and EPSS indicates very low exploitation probability (0.04%, 13th percentile).

Reflected cross-site scripting in the Bulk YouTube Post Creator WordPress plugin up to version 1.0 allows unauthenticated attackers to inject malicious scripts by tricking an authenticated user into clicking a crafted link. An attacker could hijack the victim's session, steal sensitive data, or perform actions on the victim's behalf within the context of the affected site. EPSS indicates very low exploitation probability (0.04%), and no active exploitation has been confirmed.

Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.

Reflected cross-site scripting in the Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin up to version 0.5.8.4 allows unauthenticated attackers to inject arbitrary web scripts via crafted requests. Successful exploitation requires a victim to click a malicious link, leading to script execution in the victim's browser, which may steal session cookies or deface pages. No evidence of active exploitation or public exploit code exists at this time.

Reflected cross-site scripting (XSS) in the WordPress plugin FormLift for Infusionsoft Web Forms (versions up to 7.5.20) allows remote unauthenticated attackers to inject arbitrary web scripts via user-supplied input. Exploitation requires a victim to click a malicious link, but can lead to session theft, phishing, and other browser-based attacks. The vulnerability carries a CVSS score of 7.1, though EPSS indicates a very low (0.04%) probability of exploitation; no active exploitation or public exploit code has been identified.

Reflected Cross-Site Scripting (XSS) in the mojoomla School Management WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts via unsanitized input, exploiting victims who click a crafted link. This vulnerability affects plugin versions through 92.0.0, with no known public exploit or active exploitation reported at the time of analysis.

Reflected cross-site scripting in the Sneeit MagOne WordPress theme up to version 8.5 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a specially crafted link. This can lead to session hijacking, data theft, or site defacement. No public exploit or active exploitation has been reported, and the EPSS probability is very low at 0.04%.

Reflected cross-site scripting in the Smart Notification WordPress plugin up to version 10.3 enables unauthenticated attackers to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link. This can lead to session hijacking, credential theft, or malicious actions on behalf of the victim. While no active exploitation or public exploit code is currently reported, the low CVSS impact and very low EPSS score suggest limited real-world risk at this time.

Reflected cross-site scripting in the HYDRO WordPress theme (versions ≤2.8) allows unauthenticated attackers to inject arbitrary web scripts after a victim clicks a crafted link, enabling session hijacking or unauthorized actions in the victim's browser. No public exploit code or active exploitation was identified at time of analysis, and EPSS predicts very low exploitation probability (0.04%).

Stored cross-site scripting in the Seven Stars WordPress theme by themeton allows unauthenticated attackers to inject malicious scripts into the site that execute when other users-such as admins-view the affected page. The vulnerability affects versions 1.4.4 and earlier, and while no active exploitation has been confirmed, publicly available proof-of-concept exploits likely exist given the nature of stored XSS. CVSS 7.1 indicates high severity, but EPSS estimates only a 0.04% probability of exploitation.

Stored cross-site scripting in Woocommerce Line Notify plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts that execute when a victim views an affected page, potentially leading to session hijacking or unauthorized actions. All versions up to 1.1.7 are vulnerable; no active exploitation or public proof-of-concept has been confirmed despite a High CVSS score of 7.1. The EPSS score of 0.04% indicates extremely low likelihood of real-world exploitation at this time.

Reflected cross-site scripting (XSS) in the WP Front User Submit / Front Editor WordPress plugin versions up to 4.9.3 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. The attack requires user interaction (e.g., clicking a link) and can lead to script execution in the victim’s browser, potentially enabling data theft or defacement. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread exploitation.

Reflected cross-site scripting in the Evangelische Termine WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a malicious link. Versions up to and including 3.3 are affected. Exploitation requires user interaction, and no active exploitation or public proof-of-concept has been identified at this time.

Reflected cross-site scripting in the Backwp WordPress plugin up to version 2.0.2 allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser when a malicious link is clicked. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and an EPSS score of 0.04%, indicating a low probability of widespread exploitation. No public exploit code or active exploitation has been identified at the time of analysis.

Reflected cross-site scripting (XSS) in the Photo Express for Google WordPress plugin up to version 0.3.2 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. Successful exploitation could lead to cookie theft, session hijacking, or defacement, but requires user interaction to click a crafted link. No active exploitation or public exploit code has been identified.

Stored cross-site scripting (XSS) in FasterThemes FastBook WordPress plugin through version 1.1 allows unauthenticated attackers to inject malicious scripts via web page input. When an administrator or other site user views the affected page, the script executes in their browser, potentially leading to session hijacking or credential theft. No active exploitation or public PoC is known, and EPSS estimates a very low exploitation probability (0.04%).

Reflected cross-site scripting (XSS) in the WPCRM WordPress plugin <= 3.2.0 allows unauthenticated attackers to inject arbitrary web scripts via crafted parameters. An attacker can trick a victim into clicking a malicious link, leading to session theft or defacement. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation likelihood.

Stored cross-site scripting in the SpecFit Virtual Try-On Woocommerce plugin for WordPress allows unauthenticated attackers to inject malicious scripts into pages that are later viewed by other users, potentially leading to session hijacking, data theft, or site defacement. The vulnerability affects versions up to 7.0.6; no active exploitation or public exploit is known at the time of analysis, and the EPSS score is low (0.04%).

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stored Cross-Site Scripting in the Osom Blocks WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the class_name parameter, executing whenever a user views the compromised page. The vulnerability affects all versions up to 1.2.1 and carries a CVSS score of 6.4 (Medium) with an EPSS probability of 0.04%, indicating low exploitation likelihood. No active exploitation (KEV) or public exploit code has been identified at this time.

The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.

The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms that allow an attacker to store on database and then inject HTML and/or Javascript on the page. The solution is to upgrade to Horizon 33.1.6, 33.1.7 or Meridian 2024.2.6, 2024.2.7 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Fábio Tomé for reporting this issue.

Cross-site scripting in xuxueli xxl-sso 1.1.0 login page allows remote attackers to inject arbitrary web script via the errorMsg parameter. The vulnerability is publicly disclosed with exploit code available, but no active exploitation has been confirmed by CISA KEV. Successful exploitation could lead to session hijacking or defacement if an administrator or user interacts with a crafted link.

Cross-site scripting in WeGIA 3.4.0 allows remote attackers with low privileges to inject scripts via employee registration form fields. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed. The vendor did not respond to disclosure, leaving the vulnerability unpatched.

A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.

Cross-site scripting in WeGIA 3.4.0 allows a remote authenticated low-privileged attacker to inject arbitrary web script via the 'Insira o novo tipo' parameter in the adicionar_tipoSaida.php page. Successful exploitation requires user interaction and can lead to session hijacking or unauthorized actions on behalf of the victim. Public exploit code exists but no active widespread exploitation has been reported.

Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira o novo tipo' parameter in /html/matPat/adicionar_tipoEntrada.php. The vulnerability requires an authenticated user to click a malicious link, but exploit code is publicly available. No active exploitation has been confirmed.

Cross-site scripting in LabRedesCefetRJ WeGIA 3.4.0 allows remote authenticated attackers with user interaction to inject arbitrary web script via the Nome/Sobrenome fields. The vulnerability has a publicly available proof-of-concept but no confirmed active exploitation; EPSS indicates low exploitation probability.

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.

Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.

Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira a nova categoria' parameter in adicionar_categoria.php. The vulnerability requires authentication and user interaction but can lead to content spoofing or session manipulation. A public proof-of-concept is available, though no active exploitation has been confirmed.

Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira a nova unidade' parameter in the Adicionar Unidade page. The vendor has not responded to early disclosure, and public exploit code exists, but no evidence of active exploitation has been confirmed.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects Paragraphs table: from 2.0.0 before 2.0.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16.

Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.

Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report.

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient input sanitization and output escaping. The unfiltered field names are stored alongside the sanitized values. Later, the admin-side AJAX endpoint ajax_get_table_data() returns those raw names as JSON column headers, and the client-side DataTables renderer injects them directly into the DOM without any HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stored cross-site scripting in the Royal Elementor Addons plugin for WordPress up to version 1.7.1024 allows authenticated attackers with at least contributor privileges to inject arbitrary web scripts via multiple vulnerable widgets. The injected scripts execute when any user accesses an affected page, potentially leading to session hijacking or content manipulation. EPSS score indicates low exploitation probability, and no active exploitation has been reported.

The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stored cross-site scripting in the Web Cam plugin for WordPress up to version 1.0 enables authenticated attackers (Contributor+) to inject arbitrary JavaScript via the slug parameter, affecting users who view injected pages. No active exploitation or public proof-of-concept has been identified, and EPSS indicates low exploitation probability (0.05%).

Stored cross-site scripting in the Namasha By Mdesign WordPress plugin allows authenticated attackers with Contributor-level access to inject JavaScript via the ‘playicon_title’ parameter. All plugin versions up to 1.2.00 are affected, enabling script execution when other users view the injected content. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability (0.04%).

The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.

The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.