Search: xss.is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Text – Give your texts many typing effects text-typing allows Stored XSS.This issue affects Typing Text – Give your texts many typing effects: from n/a through 2.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content Slider Block content-slider-block allows Stored XSS.This issue affects Content Slider Block: from n/a through 3.2.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9.

Webasyst Framework versions through 4.4.0 have a stored cross-site scripting (XSS) vulnerability in the Photos app. Authenticated backend users with album edit permissions can inject JavaScript via the album url parameter. This injection occurs because the url parameter is not properly escaped in the DialogAlbumSettings.html file, allowing script execution in administrator backend sessions.

HtmlSanitizer versions before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contain a cross-site scripting (XSS) vulnerability. The issue arises because the SanitizeDom(string) method does not sanitize attributes on the html and body wrapper elements. An attacker can exploit this by injecting a second html or body tag with event handlers such as onload, causing script execution when the application renders the serialized document or body outer HTML. This vulnerability has a low severity score and has been fixed in versions 9.2.1039 and 10.0.1037-beta.

RosarioSIS versions prior to 12.9.2 contain a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, potentially enabling administrative actions.

A stored Cross-Site Scripting (XSS) vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2 allows an attacker to inject malicious scripts via HTML-type custom contact fields. The injected script executes when a user views the affected contact's detail page, potentially enabling administrative actions such as creating admin accounts or accessing sensitive data. This vulnerability has a high severity score of 8.2 and is fixed in version 7.2.2.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins B Slider (b-slider) up to version 2.2.2. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute script code in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in the Advanced Post Block - Post Grid plugin for WordPress block editor, affecting versions up to 2.5.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and user interaction to execute malicious scripts in a way that affects confidentiality, integrity, and availability.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer versions up to 1.8.3. This vulnerability results from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.

A stored cross-site scripting (XSS) vulnerability exists in the WP Smart Widgets Better Post & Filter Widgets for Elementor plugin, affecting versions up to 1.9.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in Dylan Kuhn Geo Mashup versions up to 1.13.22. This vulnerability results from improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.