Search: xss.is

A stored Cross-site Scripting (XSS) vulnerability exists in the bPlugins Video Gallery Block plugin up to version 1.6.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A Stored Cross-site Scripting (XSS) vulnerability exists in the Igor Funa Ad Inserter plugin up to version 2.8.18. This vulnerability involves improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability has a CVSS score of 6.5, indicating a medium severity level with potential impacts on confidentiality, integrity, and availability.

A stored cross-site scripting (XSS) vulnerability exists in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to upload script content that executes in other users' browsers, potentially leading to unauthorized actions or data exposure.

A stored cross-site scripting (XSS) vulnerability exists in Gemini Labs Site Reviews up to version 8.3.5. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to inject malicious scripts that execute in other users' browsers when they view the affected work-notes. The vulnerability has a medium severity rating with a CVSS score of 5.1. No patch or remediation details are currently provided.

A Stored Cross-site Scripting (XSS) vulnerability exists in CozyThemes Cozy Blocks cozy-addons, affecting versions up to 2.2.27. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

Zimbra Collaboration versions prior to 10.1.21 are vulnerable to a stored cross-site scripting (XSS) flaw in the Classic UI. The vulnerability arises from improper sanitization of the From email header during HTML reply composition. An attacker can craft an email with a malicious From header containing JavaScript, which executes when the victim replies in HTML mode with reply headers disabled. This may allow session theft or unauthorized actions. The issue is fixed in version 10.1.21.

Zimbra Collaboration versions prior to 10.1.21 are vulnerable to a stored cross-site scripting (XSS) flaw via the Content-Location MIME header in email attachments. An unauthenticated attacker can send a crafted email containing a malicious Content-Location header set to a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the embedded JavaScript executes in the victim's browser context. This vulnerability was fixed in version 10.1.21.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.