Cross-Site Scripting

Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light plugin (versions up to 3.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to trick authenticated users into performing unintended actions, resulting in persistent XSS payload injection that affects all subsequent visitors. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world exploitability without requiring elevated privileges.

Stored cross-site scripting in the Premium Packages plugin for WordPress allows authenticated attackers with low privileges to inject scripts that execute in other users' browsers when they view the malicious content. Versions up to 6.0.2 are affected, and no public exploit or active exploitation has been reported; EPSS estimates a 0.05% chance of exploitation.

Stored cross-site scripting in Chaport WordPress plugin up to version 1.1.5 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in wpdive Nexa Blocks up to version 1.1.0 enables authenticated attackers with low privileges to inject malicious scripts into pages, leading to arbitrary script execution in the browsers of users who view the contaminated content. This can result in session hijacking, phishing, or site defacement. No active exploitation or public exploit has been identified; EPSS indicates low exploitation probability.

Stored cross-site scripting in BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.

Stored cross-site scripting in All Currencies for WooCommerce plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).

Stored cross-site scripting in Post Custom Templates Lite allows authenticated high-privilege attackers to inject scripts that execute in other users' browsers. Affected versions up to 1.14. No active exploitation or public exploit code identified; EPSS indicates very low exploitation likelihood.

Stored cross-site scripting in Pinterest Verify Meta Tag WordPress plugin up to version 1.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.

Stored cross-site scripting in the Melipayamak WordPress plugin version 2.2.12 and earlier allows high-privilege authenticated users to inject malicious scripts that execute in other users' browsers, potentially hijacking sessions or redirecting to malicious sites. Exploitation requires user interaction; no active exploitation or public proof-of-concept has been observed, and EPSS indicates very low exploitation probability.

Cross-site scripting in the IFrame Widget WordPress plugin allows stored script injection by authenticated high-privilege users. Affected versions up to 4.1 enable attackers to execute arbitrary JavaScript in the browsers of visitors, potentially compromising user sessions or site integrity. No active exploitation or public exploit code is confirmed, and EPSS predicts low exploitation likelihood.

Stored cross-site scripting (XSS) in Broadly for WordPress plugin up to version 3.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored Cross-Site Scripting (XSS) in the Responsify WP WordPress plugin version 1.9.11 and earlier allows authenticated attackers with high privileges to inject arbitrary web scripts into pages viewed by other users. The injected code executes in the victim’s browser when they access an affected page, potentially leading to session hijacking, content manipulation, or other client-side attacks. No public exploit code or active exploitation has been reported at this time.

DOM-based cross-site scripting in NickDuncan Contact Form plugin for WordPress ≤2.0.12 allows authenticated low-privilege users to inject arbitrary web scripts. When a higher-privilege user interacts with the malicious content, the script executes in their browser, potentially compromising the session. EPSS indicates very low exploitation likelihood (0.05%), and no active exploitation or public PoC is currently known.

Stored cross-site scripting in the WordPress plugin «Подсказки» от DaData.ru up to version 1.0.6 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in ACF: Yandex Maps Field plugin for WordPress up to version 1.1 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation identified.

Stored cross-site scripting in WP Biographia 4.0.0 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

Stored cross-site scripting in Powie's Uptime Robot WordPress plugin up to version 0.9.7 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in Deetronix Booking Ultra Pro WordPress plugin 1.1.20 and earlier allows authenticated high-privilege attackers to inject arbitrary web scripts. Users who view affected plugin pages can trigger execution, leading to session hijacking or malicious actions in their browser context. No active exploitation or public exploit code has been identified, and EPSS indicates a very low exploitation probability (0.04%, 13th percentile).

Stored cross-site scripting in WP Featured Content Slider 2.6 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view the slider. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in Global Translator WordPress plugin up to version 2.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.

Stored cross-site scripting in Elegant Visitor Counter plugin for WordPress up to version 3.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

Stored cross-site scripting (XSS) in AppBanners WordPress plugin up to version 1.5.14 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in YouTube Simple Gallery WordPress plugin up to version 2.2.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

Stored cross-site scripting (XSS) in The Holiday Calendar WordPress plugin up to version 1.18.2.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).

Stored cross-site scripting in the Read More Login WordPress plugin (≤2.0.3) allows high-privileged attackers to inject scripts executed by other users. Exploitation requires administrator access and user interaction, and no public exploit or active exploitation has been identified. The vulnerability poses limited risk due to required privileges and very low exploitation probability (EPSS 0.04%).

A cross-site scripting vulnerability in Soli WP Mail Options allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.

CSRF vulnerability in mail250 Free WP Mail SMTP (versions up to 1.0) that enables stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts via crafted requests. The vulnerability requires user interaction (UI:R) but has network-based attack vector (AV:N) with low complexity (AC:L), affecting WordPress installations using this email plugin. While CVSS 7.1 indicates medium-high severity with confidentiality, integrity, and availability impact, real-world exploitation depends on KEV status, EPSS probability, and public POC availability-data not provided in the source material.

Cross-Site Request Forgery (CSRF) vulnerability in the dilemma123 Recent Posts Slider Responsive WordPress plugin (versions through 1.0.1) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads, which execute in the browsers of site administrators and visitors, potentially leading to account compromise, malware distribution, or defacement. The vulnerability requires user interaction (UI:R) but has network-accessible attack surface (AV:N) with moderate CVSS score of 7.1 and should be prioritized for patched WordPress installations running vulnerable plugin versions.

Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon (versions up to 2.0) that enables Stored XSS attacks. An unauthenticated attacker can craft a malicious request that, when visited by a user, executes arbitrary JavaScript in the victim's browser context with access to sensitive data and session tokens. While no public exploit or KEV status confirmation is available from the provided data, the CVSS 7.1 score and Stored XSS payload persistence indicate moderate-to-high real-world risk, particularly if the plugin has significant user adoption.

Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov's Bg Orthodox Calendar plugin that enables Stored Cross-Site Scripting (XSS) attacks. The vulnerability affects all versions from an unspecified baseline through 0.13.10, allowing unauthenticated attackers over the network to inject and store malicious scripts that execute in users' browsers with moderate impact to confidentiality, integrity, and availability. The CVSS 7.1 score reflects the combination of network attack vector with user interaction requirement; real-world exploitation risk depends on whether this vulnerability is actively exploited or has public proof-of-concept code available.

Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai's Post Author WordPress plugin (versions through 1.1.1) that enables Stored Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in the browsers of all users viewing affected content, potentially leading to account compromise, data theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating practical exploitability without authentication.

Cross-Site Request Forgery (CSRF) vulnerability in the codedraft Mediabay WordPress plugin (versions up to 1.4) that enables reflected XSS attacks. Attackers can exploit this network-accessible vulnerability without authentication to perform unauthorized actions on behalf of authenticated users and inject malicious scripts, affecting WordPress installations using this media library plugin. The CVSS 7.1 score and absence of KEV/active exploitation data suggest moderate real-world risk with UI interaction required.

DOM-Based Cross-Site Scripting (XSS) in Simple Google Static Map plugin for WordPress versions up to 1.0.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.

The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stored cross-site scripting in The Plus Addons for Elementor Page Builder Lite up to version 6.2.7 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).

Stored cross-site scripting in PickPlugins Wishlist plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into wishlist pages. Affects versions through 1.0.43. No public exploit or active exploitation identified.

Stored cross-site scripting in WidgetKit for Elementor allows authenticated attackers with contributor-level access to inject malicious scripts via widget settings. The vulnerability affects all versions up to 2.5.4 and can lead to session hijacking or defacement when an admin views the compromised page. No public exploit or active exploitation has been identified.

Stored cross-site scripting in Ocean Extra WordPress plugin up to version 2.4.8 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.

Stored cross-site scripting in Nasa Core WordPress plugin before 6.4.1 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified, and EPSS score is low (0.05%).

A reflected cross-site scripting (XSS) vulnerability exists in Daman Jeet's Real Time Validation for Gravity Forms plugin affecting versions through 1.7.0, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise user sessions, steal credentials, or deface form content due to its cross-site impact scope. While the CVSS score of 7.1 indicates moderate-to-high severity, real-world exploitation depends on form visibility and user interaction patterns.

Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.

Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.

Stored cross-site scripting in code-projects Traffic Offense Reporting System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via multiple parameters in /save-reported.php. Public exploit code exists, but EPSS score is low (0.05%) and no active exploitation has been reported.

Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Title field on the Announcement page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).

The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Runners Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The BNS Featured Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Freemind Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'freemind' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Division parameter on the Division System page. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.

Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated user with high privileges to inject arbitrary JavaScript via the Remark field on the Grading System page. The exploit is publicly available, but EPSS score is low (0.06%) and no active exploitation has been reported.

Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Subject field on the Subjects page. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.

Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Class Name field on the Classes page. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported and the EPSS score is low (0.09%).

Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Academic Term field in the Add Academic Term page. The vulnerability is publicly exploited with a proof-of-concept available, though EPSS score is low (0.09%) and no active exploitation in CISA KEV has been reported.

Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated high-privilege user to inject malicious scripts via the email field on the profile update page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).

Stored cross-site scripting in iSoluçõesWEB up to 20250519 allows an authenticated attacker with low privileges to inject malicious scripts via the 'Descrição da solicitação' parameter in the /fluxos-dashboard endpoint. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.06%).

A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part of the file /save-settings.php of the component Setting Handler. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.

A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.

The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affects some unknown processing of the file saveuser.php. The manipulation of the argument user_id/username/email/name/position leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A vulnerability, which was classified as problematic, has been found in SourceCodester Food Menu Manager 1.0. Affected by this issue is some unknown functionality of the file /index.php of the component Add Menu Handler. The manipulation of the argument name/description leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the `<iframe srcdoc>` attribute, which leads to cross-site scripting (XSS) by loading an attacker's UserJS inside `<script src>`. In order to execute the attack, the attacker needs to control one of the victim's feeds and have an account on the FreshRSS instance that the victim is using. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 contains a patch for the issue.

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting (XSS) issue that occurs in `f.php` when SVG favicons are downloaded from an attacker-controlled feed containing `<script>` tags inside of them that aren't sanitized, with the lack of CSP in `f.php` by embedding the malicious favicon in an iframe (that has `sandbox="allow-scripts allow-same-origin"` set as its attribute). An attacker needs to control one of the feeds that the victim is subscribed to, and also must have an account on the FreshRSS instance. Other than that, the iframe payload can be embedded as one of two options. The first payload requires user interaction (the user clicking on the malicious feed entry) with default user configuration, and the second payload fires instantly right after the user adds the feed or logs into the account while the feed entry is still visible. This is because of lazy image loading functionality, which the second payload bypasses. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 has a patch for the issue.

VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.

VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.

VMware NSX Manager UI is vulnerable to stored cross-site scripting (XSS) attacks via improper input validation in user-controllable fields (CWE-79). An authenticated attacker with high privileges can inject malicious scripts that persist in the application and execute in the browsers of other users, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. With a CVSS score of 7.5 and network-accessible attack vector, this vulnerability poses a moderate-to-high risk to NSX Manager deployments, particularly in multi-user environments.

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper sanitization of user input to the web-based management interface. An attacker could exploit this vulnerability by submitting a malicious script through the interface. A successful exploit could allow the attacker to conduct a stored XSS attack on the affected system.

A vulnerability in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Marketing/Offers and Content/Pages components.

A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as problematic. Affected is an unknown function of the file /doctor/edit-patient.php?editid=2 of the component POST Parameter Handler. The manipulation of the argument patname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filter[dateFrom] GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin or editor privileges to inject arbitrary JavaScript code by crafting a malicious URL.

The Simple Contact Form Plugin for WordPress - WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Campus Directory - Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Employee Directory - Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Parent Controls Page. The manipulation of the argument Device Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been classified as problematic. Affected is an unknown function of the file /boafrm/formPortFw of the component Virtual Server Page. The manipulation of the argument service_type leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the file /boafrm/formFilter of the component URL Filtering Page. The manipulation of the argument URL Address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been rated as problematic. Affected by this issue is some unknown functionality of the component IP Port Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

XSS in MailEnable before v10 via failure.aspx. EPSS 11.5%. PoC available.