Filtered by CWE-79
Filtered by vendor Subscriptions
Total 45049 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-39031 1 Silverpeas 1 Silverpeas 2025-06-05 5.4 Medium
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event.
CVE-2023-5942 2 Drelton, Medialist 2 Medialist, Medialist 2025-06-05 5.4 Medium
The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2023-2707 1 Gappointments 1 Gappointments 2025-06-05 4.8 Medium
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-44383 1 Octobercms 1 October 2025-06-05 5.4 Medium
October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.
CVE-2024-22725 1 Orthanc-server 1 Orthanc 2025-06-05 6.1 Medium
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
CVE-2024-27186 1 Joomla 1 Joomla\! 2025-06-04 6.1 Medium
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
CVE-2024-40743 1 Joomla 1 Joomla\! 2025-06-04 6.1 Medium
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
CVE-2024-40745 1 Convert Forms Project 1 Convert Forms 2025-06-04 5.4 Medium
Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8.
CVE-2024-40747 1 Joomla 1 Joomla\! 2025-06-04 6.1 Medium
Various module chromes didn't properly process inputs, leading to XSS vectors.
CVE-2024-40748 1 Joomla 1 Joomla\! 2025-06-04 7.5 High
Lack of output escaping in the id attribute of menu lists.
CVE-2024-10144 1 Robosoft 1 Robo Gallery 2025-06-04 4.8 Medium
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-10054 1 Happyforms 1 Happyforms 2025-06-04 4.8 Medium
The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-10107 1 Seedprod 1 Rafflepress 2025-06-04 4.8 Medium
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-10145 1 Devpups 1 Social Pug 2025-06-04 4.8 Medium
The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-10504 1 Reputeinfosystems 1 Arforms 2025-06-04 5.4 Medium
The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
CVE-2024-11109 1 Ljapps 1 Wp Google Review Slider 2025-06-04 4.8 Medium
The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2025-4852 1 Totolink 2 A3002r, A3002r Firmware 2025-06-04 2.4 Low
A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the component VPN Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-6668 1 Wpproking 1 Profilepro 2025-06-04 5.4 Medium
The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks
CVE-2024-6708 1 Cozmoslabs 1 Profile Builder 2025-06-04 4.8 Medium
The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.
CVE-2024-7758 1 Stylishpricelist 1 Stylish Price List 2025-06-04 4.8 Medium
The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).