Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 37 of 70
Dec 14, 2023A reflected XSS vulnerability was discovered in the Quickform component for Joomla.CVE-2023-40656 · Other software · plasma-web.ru · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Quickform component for Joomla.
- Product
- Quickform component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.CVE-2023-40655 · Other software · mooj.org · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.
- Product
- Proforms Basic component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.CVE-2023-40628 · Other software · Extplorer.net · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.
- Product
- Extplorer component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.CVE-2023-40627 · Other software · https://github.com/MLWebTechnologies · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.
- Product
- LivingWord component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 13, 2023Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.CVE-2023-41618 · Other software · Emlog · reported by MITREMedium 6.1
Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023SAS application is vulnerable to Reflected Cross-Site Scripting (XSS).CVE-2023-4932 · Other software · SAS Institute · reported by cvd@cert.plMedium 6.3
SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.
- Product
- SAS Integration Technologies
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.CVE-2023-49494 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php.CVE-2023-49490 · Other software · Xunruicms · reported by MITREMedium 6.1
XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php.
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2023Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.CVE-2022-48614 · Other software · Semantic-mediawiki · reported by MITREMedium 6.1
Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.
- Product
- Semantic Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsemantic-mediawiki.org
Dec 7, 2023NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.CVE-2023-41905 · Other software · Netscout · reported by MITREMedium 5.4
NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Dec 7, 2023NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability.CVE-2023-41170 · Other software · Netscout · reported by MITREMedium 6.1
NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Dec 7, 2023DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.CVE-2023-49493 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php.CVE-2023-49492 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POSTCVE-2023-6568 · Other software · mlflow · reported by security@huntr.devMedium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023Email Subscription Popup: Reflected Cross-Site ScriptingCVE-2023-6527 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Email Subscription Popup
- Affected
- up to 1.2.18
- What to do
- Affects up to 1.2.18. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2023 Dell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability.CVE-2023-44301 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability. A network attacker with low privileges could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.CVE-2023-6461 · Other software · viliusle · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.
- Product
- viliusle/minipaint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023An Improper Input Validation vulnerability in Schweitzer Engineering Laboratories SEL-411L could allow an attacker to perform reflection attacks against an authCVE-2023-2267 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comMedium 4.3
An Improper Input Validation vulnerability in Schweitzer Engineering Laboratories SEL-411L could allow an attacker to perform reflection attacks against an authorized and authenticated user. See product Instruction Manual Appendix A dated 20230830 for more details.
- Product
- SEL-411L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023 A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than versionCVE-2021-36806 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 4.7
A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than version 4.5.3.4.
- Product
- Sophos Email Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.sophos.comcommunity.sophos.com
Nov 29, 2023 In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerabCVE-2023-6217 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.1
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Nov 23, 2023Usedesk before 1.7.57 allows filter reflected XSS.CVE-2023-49215 · Other software · Usedesk · reported by MITREMedium 6.1
Usedesk before 1.7.57 allows filter reflected XSS.
- Product
- Usedesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS.CVE-2023-4406 · Websites & servers · KC Group · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Commerce Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38883 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38882 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38881 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id', 'school_date', 'month' or 'year' parameters in 'CalendarModal.php'.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-44352 · Websites & servers · Adobe · reported by AdobeMedium 6.1
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 17, 2023Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject aCVE-2023-47797 · Other software · Liferay · reported by security@liferay.comCritical 9.6
Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordliferay.devliferay.dev
Nov 15, 2023Namaste! LMS: Reflected Cross-Site ScriptingCVE-2023-4602 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and including, 2.6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Namaste! LMS
- Affected
- up to 2.6.1.1
- What to do
- Affects up to 2.6.1.1. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddrive.google.complugins.trac.wordpress.org
Nov 15, 2023EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.CVE-2023-41597 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Michael Uno: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-47520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Uno (miunosoft) Responsive Column Widgets plugin <= 1.2.7 versions.
- Product
- Michael Uno
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Michael Uno to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 14, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.CVE-2023-6128 · Other software · salesagility · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
- Product
- salesagility/suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023Star CloudPRNT for WooCommerce: Reflected Cross-Site ScriptingCVE-2023-4603 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Star CloudPRNT for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'printersettings' parameter in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Star CloudPRNT for WooCommerce
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Star CloudPRNT for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddrive.google.complugins.trac.wordpress.org
Nov 8, 2023HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browseCVE-2023-37533 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal cookie-based authentication credentials and comprise a user's account then launch other attacks.
- Product
- HCL Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Nov 6, 2023Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability.CVE-2023-5950 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.6
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).
- Product
- Velociraptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023Digirisk: Reflected Cross-Site ScriptingCVE-2023-5946 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Digirisk
- Affected
- 6.0.0.0 to 6.0.0.0
- What to do
- Affects 6.0.0.0 to 6.0.0.0. Update Digirisk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 1, 2023Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string inCVE-2023-46448 · Other software · Dmpop · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images.
- Product
- Mejiro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.0xzon.devgithub.com
Oct 31, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5891 · Other software · pkp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arCVE-2023-47096 · Other software · Virtualmin · reported by MITREMedium 5.4
A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Cloudmin services master field.
- Product
- Virtualmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.CVE-2023-5863 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2023Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher.CVE-2023-46858 · Other software · Moodle · reported by MITREMedium 5.4
Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content [are] used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.moodle.orggist.github.com
Oct 26, 2023Conversios Track Google Analytics 4, Facebook Pixel & Conversions API: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-46094 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.3 versions.
- Product
- Conversios Track Google Analytics 4, Facebook Pixel & Conversions API
- Fixed in
- 6.5.4
- What to do
- Update Conversios Track Google Analytics 4, Facebook Pixel & Conversions API to 6.5.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.CVE-2023-43906 · Other software · Onworks · reported by MITREMedium 6.1
Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
- Product
- Xolo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack.CVE-2023-5758 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Oct 25, 2023Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session CVE-2023-1356 · Other software · IDAttend Pty Ltd · reported by vdp@themissinglink.com.auHigh 7.5
Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session by attackers who have convinced the said user to click on a malicious link.
- Product
- IDWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 21, 2023EventON: Reflected Cross-Site ScriptingCVE-2023-4635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- EventON
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 20, 2023nsc: Reflected Cross-Site ScriptingCVE-2023-3965 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- nsc
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update nsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Oct 20, 2023Winters: Reflected Cross-Site ScriptingCVE-2023-3962 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Winters
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Winters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Oct 20, 2023Your Journey: Reflected Cross-Site ScriptingCVE-2023-3933 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Your Journey
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Your Journey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Oct 18, 2023Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminCCVE-2023-45958 · Other software · Thirtybees · reported by MITREMedium 6.1
Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.
- Product
- Thirty Bees
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4CVE-2023-44311 · Other software · Liferay · reported by security@liferay.comCritical 9.6
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Product
- DXP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordliferay.devliferay.dev
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.