Filtered by CWE-79
Filtered by vendor Subscriptions
Total 45094 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-34654 1 Custom Post Type Relations Project 1 Custom Post Type Relations 2025-05-05 6.1 Medium
The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVE-2021-34651 1 Scribblemaps 1 Scribble Maps 2025-05-05 6.1 Medium
The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
CVE-2021-34656 1 Videowhisper 1 2way Videocalls And Random Chat 2025-05-05 6.1 Medium
The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7.
CVE-2021-34657 1 Typofr Project 1 Typofr 2025-05-05 6.1 Medium
The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.11.
CVE-2021-34666 1 Add Sidebar Project 1 Add Sidebar 2025-05-05 6.1 Medium
The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.0.
CVE-2021-34667 1 Calendar Plugin Project 1 Calendar Plugin 2025-05-05 6.1 Medium
The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calendar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
CVE-2021-34641 1 Seopress 1 Seopress 2025-05-05 6.4 Medium
The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.
CVE-2022-43046 1 Oretnom23 1 Food Ordering Management System 2025-05-05 4.8 Medium
Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php.
CVE-2021-38315 1 Smartypantsplugins 1 Sp Project \& Document Manager 2025-05-05 6.1 Medium
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.
CVE-2021-38316 1 Wp Academic People List Project 1 Wp Academic People List 2025-05-05 6.1 Medium
The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1.
CVE-2024-32206 1 Wuzhicms 1 Wuzhicms 2025-05-05 4.6 Medium
A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata parameter.
CVE-2024-27757 1 Flusity 1 Flusity 2025-05-05 6.1 Medium
flusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024."
CVE-2018-10391 1 Wuzhicms 1 Wuzhicms 2025-05-05 N/A
An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI.
CVE-2018-17425 1 Wuzhicms 1 Wuzhicms 2025-05-05 N/A
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.
CVE-2018-18938 1 Wuzhicms 1 Wuzhicms 2025-05-05 N/A
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.
CVE-2018-10311 1 Wuzhicms 1 Wuzhicms 2025-05-05 N/A
A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tag[pinyin] parameter to the /index.php?m=tags&f=index&v=add URI.
CVE-2019-9110 1 Wuzhicms 1 Wuzhicms 2025-05-05 N/A
XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php.
CVE-2018-10313 1 Wuzhicms 1 Wuzhicms 2025-05-05 N/A
WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set_iframe=1 URI.
CVE-2023-31860 1 Wuzhicms 1 Wuzhicms 2025-05-05 5.4 Medium
Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.
CVE-2018-14512 1 Wuzhicms 1 Wuzhicms 2025-05-05 6.1 Medium
An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[nickname] parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server" screen, the XSS payload is triggered.