Cross-Site Scripting

Stored cross-site scripting in ATP Call Now WordPress plugin up to version 1.0.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).

Stored cross-site scripting in CodePen Embed Block plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. This issue affects versions through 1.1.1 and has a low EPSS score with no public exploit identified.

Stored cross-site scripting in WP-FB-AutoConnect plugin for WordPress allows authenticated administrators to inject malicious scripts via improperly neutralized input. Affects versions up to 4.6.3. No public exploit or active exploitation identified; EPSS score is low (0.04%).

Stored cross-site scripting (XSS) in Better Random Redirect WordPress plugin versions up to 1.3.20 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in RDFa Breadcrumb WordPress plugin through version 2.3 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).

Stored cross-site scripting in Simple Sticky Footer WordPress plugin up to version 1.3.5 allows authenticated users with high privileges to inject arbitrary web scripts into pages, which execute when other users access the affected page. No public exploit or active exploitation identified; EPSS score is low (0.04%).

Stored cross-site scripting in Tealium WordPress plugin up to version 2.1.17 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in WP Voting Contest plugin for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 5.8 and has a low EPSS score with no public exploit identified.

Stored cross-site scripting (XSS) in the WordPress plugin IP Based Login through version 2.4.2 allows authenticated administrators to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting vulnerability in the Hand Talk WordPress plugin up to version 6.0 allows authenticated users with high privileges to inject malicious scripts into web pages. An attacker with admin-level access can store XSS payloads that execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

Stored cross-site scripting (XSS) vulnerability in the PDPA Consent for Thailand WordPress plugin up to version 1.1.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts into web pages. This can lead to session hijacking, defacement, or redirection to malicious sites when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting (XSS) in CSV Importer Improved WordPress plugin up to version 0.6.1 allows authenticated users with high privileges to inject malicious scripts via imported CSV data. The vulnerability is triggered when an administrator views the imported data, leading to script execution in the admin context. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting (XSS) in Inventory Presser WordPress plugin up to version 15.0.0 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

Stored cross-site scripting in Recipes manager - WPH plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Versions through 1.0.4 are affected. No public exploit or active exploitation identified.

CVE-2025-49873 is a Reflected Cross-Site Scripting (XSS) vulnerability in NasaTheme's Elessi WordPress theme that allows unauthenticated attackers to inject malicious scripts into web pages viewed by victims. Versions up to and including 6.3.9 are affected. An attacker can steal session cookies, perform actions on behalf of users, or redirect users to malicious sites with minimal complexity (network-accessible input, user interaction required). The vulnerability lacks confirmed EPSS data and KEV listing at this time, but the CVSS 7.1 score and reflected XSS nature indicate moderate-to-high priority.

Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows an authenticated attacker to inject arbitrary web scripts via the Branch/Address/Detail parameters in /branch.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.05%), indicating low exploitation likelihood.

The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.

Stored cross-site scripting (XSS) in PHPGurukul Notice Board System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Title or Description fields in the Add Notice functionality. The attack is remotely exploitable with high privileges (admin) and requires user interaction. A public exploit exists, but no active exploitation has been reported.

A vulnerability, which was classified as problematic, has been found in PHPGurukul Bus Pass Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin-profile.php of the component Profile Page. The manipulation of the argument profile name leads to cross site scripting. The attack may be launched remotely.

Stored cross-site scripting in PHPGurukul COVID19 Testing Management System 1.0 allows authenticated attackers with low privileges to inject arbitrary JavaScript via the 'remark' parameter in /test-details.php. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).

Cross-site scripting (XSS) in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in /search-report-result.php. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).

Cross-site scripting (XSS) vulnerability in Luna Imaging up to version 7.5.5.6 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in the /luna/servlet/view/search endpoint. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).

The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Pixel Manager for WooCommerce - Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's conversion-pixel in all versions up to, and including, 1.49.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.

The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

A cross-site scripting vulnerability in Real Estate Management 1.0 (CVSS 8.1). Risk factors: public PoC available.

A cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a crafted payload into the id parameter at /members/edit.php.

The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.

Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.

A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.

A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.

A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.

DOM-based Cross-Site Scripting (XSS) in CubeWP Framework versions up to 1.1.23 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).

Stored cross-site scripting in Responsive Blocks WordPress plugin up to version 2.0.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.

DOM-based cross-site scripting in WPAdverts plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts via crafted input. The vulnerability affects versions up to 2.2.4 and requires user interaction to trigger. No public exploit or active exploitation has been identified at this time.

Stored cross-site scripting in If-So Dynamic Content Personalization plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.

Stored cross-site scripting in the Noptin WordPress plugin (newsletter-optin-box) up to version 3.8.7 allows authenticated, high-privileged attackers to inject malicious scripts that execute in the browsers of victim users. Exploitation requires administrator-level access and user interaction, limiting widespread automated attacks. No active exploitation or public proof-of-concept has been identified, and EPSS predicts a very low chance of real-world exploitation.

Stored cross-site scripting in Advanced Sermons WordPress plugin up to version 3.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into sermon pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

Stored cross-site scripting in the Ebook Store WordPress plugin allows authenticated administrators to inject malicious scripts that execute in other users' browsers when they view affected content. The vulnerability affects all plugin versions up to 5.8008, requiring high privileges and user interaction for exploitation. No active exploitation or public exploit code has been confirmed at this time.

Stored cross-site scripting in Kama Click Counter plugin for WordPress versions up to 4.0.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.

Stored cross-site scripting in WP Views Counter plugin for WordPress up to version 2.0.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.

Stored cross-site scripting in Arconix Shortcodes WordPress plugin up to version 2.1.17 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected content, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

DOM-based cross-site scripting vulnerability in Meks Flexible Shortcodes WordPress plugin up to version 1.3.7 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via crafted shortcodes. The vulnerability is triggered when a user interacts with a malicious link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).

Reflected Cross-Site Scripting (XSS) vulnerability in the Saleswonder Team Tobias WP2LEADS WordPress plugin (versions up to 3.5.0) that allows unauthenticated attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector requiring user interaction, and while KEV/active exploitation status and POC availability are not explicitly confirmed in provided data, the low attack complexity and reflected nature suggest moderate real-world risk.

Reflected Cross-Site Scripting (XSS) vulnerability in the CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress affecting versions through 5.4.8.1. An unauthenticated attacker can inject malicious scripts into web pages viewed by users with no special privileges required, potentially leading to session hijacking, credential theft, or malware distribution. The CVSS 7.1 score reflects the moderate severity with network attack vector and user interaction requirement.

Reflected Cross-Site Scripting (XSS) vulnerability in Rustaurius Ultimate Reviews WordPress plugin versions up to 3.2.14, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise session tokens, steal sensitive data, or perform actions on behalf of affected users. While this is a network-accessible, low-complexity attack with moderate CVSS score (7.1), reflected XSS vulnerabilities are commonly exploited and proof-of-concept code is typically straightforward to develop.

Reflected Cross-Site Scripting (XSS) vulnerability in WPQuark's eForm WordPress Form Builder plugin that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability affects the eForm plugin across unspecified version ranges and can be exploited with user interaction to compromise confidentiality, integrity, and availability. No active KEV designation or confirmed POC availability is documented, but the network-accessible nature and low attack complexity present moderate real-world exploitation risk.

A cross-site scripting vulnerability in Michal Jaworski Track (CVSS 7.1). High severity vulnerability requiring prompt remediation.

Reflected Cross-Site Scripting (XSS) vulnerability in NasaTheme Nasa Core versions up to 6.3.2 that allows unauthenticated attackers to inject arbitrary JavaScript code into web pages viewed by other users. The vulnerability affects the Nasa Core component through improper input neutralization during web page generation, enabling attackers to steal session cookies, perform actions on behalf of users, or distribute malware. With a CVSS score of 7.1 and low attack complexity, this vulnerability poses a moderate-to-high risk to affected installations, particularly if the affected theme is actively deployed in production environments.

Stored Cross-Site Scripting (XSS) vulnerability in CreativeMedia Elite Video Player versions up to 10.0.5 that allows unauthenticated attackers to inject and persist malicious scripts through the web page generation process. An attacker can craft a malicious input that gets stored in the application and executed in the browsers of other users who view the affected page, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (UI:R) but has a network attack vector with no authentication required, making it a moderate-to-high priority threat depending on deployment context.

The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Master Slider - Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.

Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

The WordPress Infinite Scroll - Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Wise Chat WordPress plugin versions up to 3.3.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the X-Forwarded-For header processing that allows unauthenticated attackers to inject malicious scripts without authentication or user interaction. When vulnerable pages are accessed by site visitors, the injected scripts execute in their browsers, potentially enabling credential theft, session hijacking, or malware distribution. This vulnerability has a CVSS score of 7.2 (High) and affects all publicly-facing WordPress installations running the affected plugin versions.

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27.

Stored cross-site scripting in CodeAstro Food Ordering System 1.0 allows authenticated admin users to inject arbitrary JavaScript via the Restaurant Name and Address fields in the store edit page. When viewed, the injected script executes in the victim's browser, enabling session hijacking or defacement. A public exploit exists, but no active exploitation has been confirmed.

Stored cross-site scripting in PHPGurukul Nipah Virus Testing Management System 1.0 allows authenticated attackers to inject arbitrary web scripts via the 'serachdata' parameter in /search-report.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).

Cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows remote attackers to inject arbitrary web scripts via the Name parameter in /contact.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.05%), indicating low exploitation likelihood.

Stored cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the 'pagedes' parameter in /admin/aboutus.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).

Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter.

A Reflected Cross Site Scripting (XSS) vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter.

Reflected Cross-Site Scripting (XSS) vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GET request parameter.

A cross-site scripting vulnerability (CVSS 8.7) that allows an attacker. High severity vulnerability requiring prompt remediation.

Stored cross‑site scripting in ComfyUI’s /upload/image endpoint allows unauthenticated, remote attackers to inject arbitrary web scripts by uploading a crafted image. The flaw exists in all versions up to 0.3.39 and is an incomplete fix of CVE‑2024‑10099. Public exploit code is available, though no active exploitation has been reported.

Stored cross-site scripting (XSS) vulnerability in Crafty Controller that allows authenticated attackers to inject malicious JavaScript through the Server Name form and API Key form components. An attacker with valid credentials can craft malicious input that persists in the application, executing arbitrary scripts in other users' browsers with the same security context. While CVSS 7.6 indicates high severity and the vulnerability requires low attack complexity with network accessibility, real-world risk is constrained by the requirement for prior authentication and user interaction.

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.

The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ parameter in all versions up to, and including, 3.98.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ssa_admin_upcoming_appointments, ssa_admin_upcoming_appointments, and ssa_past_appointments shortcodes in all versions up to, and including, 1.6.8.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The kk Youtube Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kkytv' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'ef_settings_submenu' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘status-classic-offline-text’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stored XSS vulnerability in XWiki affecting versions before 15.10.16, 16.4.7, and 16.10.2. An unprivileged user can inject malicious content into the NotificationDisplayerClass object of a document, which is then rendered as raw HTML when an administrator edits and saves the document, enabling XSS attacks with high integrity and confidentiality impact. The vulnerability requires low attack complexity and user interaction (admin action), with a CVSS score of 8.0 indicating significant real-world risk.