Search: xss.is

A Cross-Site Scripting (XSS) vulnerability exists in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication on iOS versions prior to 2026-08-14. This flaw allows an unauthenticated remote attacker to execute arbitrary JavaScript by leveraging a malicious iOS bundle ID. The vulnerability has a high severity rating with a CVSS score of 8.7.

ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

phpMyAdmin versions up to 5.2.3 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows database users with CREATE privileges to inject malicious scripts via unescaped table names in the DesignerHistory.display() function. When another user interacts with the affected table name in Designer query mode, the injected script executes in their session.

The Gravity Forms plugin for WordPress up to version 3.1.1 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in certain fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. The issue arises because some fields allow raw HTML submissions that bypass sanitization and are later decoded into executable markup by the browser.

The Gravity Forms plugin for WordPress versions up to and including 3.1.2 contains a stored cross-site scripting (XSS) vulnerability via the List Field. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires an administrator to click a crafted link in the entry detail view and confirm a dialog, triggering execution of attacker-supplied JavaScript code.

The Food Store plugin for WordPress versions up to and including 1.5.5 contains a stored cross-site scripting (XSS) vulnerability via the 'service_time' parameter. This vulnerability arises due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires a specific non-default configuration where 'Enable Checkout Service Fields' is disabled while 'Enable Pickup/Delivery Service' remains enabled.

The Joinchat WordPress plugin versions prior to 6.4.2 contain a vulnerability where the message of its button block is not properly escaped before being output in an HTML attribute on the front end. This flaw allows users with Author role or higher to execute stored cross-site scripting (XSS) attacks against visitors of the post, including administrators.

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the '_elementor_data.form_fields[].custom_id' parameter. This affects all versions up to and including 2.7.9. The flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability bypasses the esc_html() sanitization due to the way the plugin's frontend script processes HTML fragments with jQuery.

The User Frontend WordPress plugin versions before 4.3.14 contain a reflected cross-site scripting (XSS) vulnerability. This occurs because some user-supplied values are not properly sanitized or escaped before being reflected in HTML attributes in an AJAX response accessible to the public. The vulnerable action is protected by a nonce that only validates for logged-out users, so the XSS payload executes against visitors who are not authenticated.

The Events Made Easy WordPress plugin up to version 3.3.1 contains a stored cross-site scripting (XSS) vulnerability via the 'width' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages.

The Firelight Lightbox WordPress plugin versions prior to 2.3.23 do not properly escape URLs in links opened by its Classic lightbox feature. This vulnerability allows users with Contributor-level permissions to inject stored cross-site scripting (XSS) payloads that execute when other users click crafted links.

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module due to improper neutralization of input during web page generation. This affects versions from 0.0.0 to 3.1.7 and from 4.0.0 to 4.0.1. The vulnerability allows injection of malicious scripts into web pages generated by the module.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Signature pad widget. This flaw is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability affects Signature pad widget versions from 0.0.0 up to and including 1.15.0.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal Commerce Stripe versions 2.0.0 through 2.2.3 due to improper neutralization of input during web page generation. This flaw could allow an attacker to inject malicious scripts into web pages viewed by other users.

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal AI (Artificial Intelligence) component due to improper neutralization of input during web page generation. This vulnerability affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 of the Drupal AI module. The flaw allows injection of malicious scripts into web pages, potentially leading to client-side code execution in users' browsers.

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal AI (Artificial Intelligence) component due to improper neutralization of input during web page generation. This vulnerability affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 of the Drupal AI module. The flaw allows injection of malicious scripts into web pages, potentially impacting users who view the affected content.

A stored cross-site scripting (XSS) vulnerability exists in Drupal AI versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 due to improper neutralization of input during web page generation. This flaw allows malicious input to be stored and later executed in users' browsers when viewing affected pages.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 due to improper neutralization of input during web page generation. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users.