P7E4

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in an admin page.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because some parameters are not properly sanitised and escaped before being outputted back in attributes. This can lead to malicious scripts being injected into the website.

The issue is related to a Reflected cross-Site Scripting problem. It occurs because a `parameter` is not properly sanitised and escaped before being outputted in the response. This can lead to malicious scripts being executed.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape a `parameter` before outputting it back in an attribute in an admin page. This can lead to a reflected cross-site scripting attack.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `rows` parameter is not properly sanitised and escaped before being outputted back in an admin page. This allows for potential malicious script injection.

The issue concerns the lack of sanitization and escaping of various parameters in SQL statements via certain AJAX actions. These actions are available to any authenticated users, including those with minimal privileges like subscribers. This oversight leads to SQL injections.

The issue is related to Reflected Cross-Site Scripting. It occurs because the `PHP SELF` PHP variable is not properly sanitised and escaped before being outputted in an attribute on an admin page. This allows for malicious scripts to be reflected back to the user, potentially leading to security issues.

The issue concerns a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape arbitrary POST data before including it in the response. This allows for the potential injection of malicious scripts.

The issue arises from the lack of sanitization and escaping of the `PHP SELF` variable before it is outputted in an attribute on an admin page, leading to Reflected Cross-Site Scripting.

The issue is related to a Reflected Cross-Site Scripting problem. The Vertical scroll recent post WordPress plugin does not properly sanitise and escape a `parameter` before outputting it back in an attribute. This can lead to a Reflected Cross-Site Scripting attack.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `page` parameter is not properly sanitised and escaped before being outputted back in an attribute in the admin dashboard.

The issue concerns a Reflected Cross-Site Scripting problem. It arises because the Menubar WordPress plugin does not properly sanitise and escape the `command` parameter before including it in the response via the menubar AJAX action. This action is accessible to any authenticated users.

The issue allows unauthenticated attackers to inject arbitrary web scripts via Reflected Cross-Site Scripting. This is possible due to vulnerable POST data found in the ~/inc/admin.php file.

The issue is related to Reflected Cross-Site Scripting due to insufficient escaping and the use of `$ SERVER['PHP SELF']` found in the `~/options-fotobook.php` file. This allows attackers to inject arbitrary web scripts onto the page.

Name of the Vulnerable Software and Affected Versions: The Magic Post Voice WordPress plugin versions up to and including 1.2 Description: The issue allows attackers to inject arbitrary web scripts via the `ids` parameter found in the ~/inc/admin/main.php file, enabling Reflected Cross-Site Scripting attacks. Recommendations: For versions up to and including 1.2, consider disabling access to the ~/inc/admin/main.php file or restricting the use of the `ids` parameter until a patch is available.

Name of the Vulnerable Software and Affected Versions: WooCommerce EnvioPack WordPress plugin versions prior to 1.2 Description: The issue allows attackers to inject arbitrary web scripts via the `dataid` parameter in the ~/includes/functions.php file, enabling Reflected Cross-Site Scripting attacks. Recommendations: For versions up to and including 1.2, update to a version later than 1.2 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: H5P CSS Editor WordPress plugin versions up to and including 1.0 Description: The issue allows attackers to inject arbitrary web scripts via the `h5p-css-file` parameter in the ~/h5p-css-editor.php file, enabling Reflected Cross-Site Scripting attacks. Recommendations: For versions up to and including 1.0, update to a version that contains a fix for this issue to prevent Reflected Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the ~/h5p-css-editor.php file to minimize the risk of exploitation. Avoid using the `h5p-css-file` parameter in the affected endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: The Real WYSIWYG WordPress plugin versions up to and including 0.0.2 Description: The issue is related to Reflected Cross-Site Scripting due to the use of PHP SELF in the ~/real-wysiwyg.php file, allowing attackers to inject arbitrary web scripts. Recommendations: For versions up to and including 0.0.2, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the ~/real-wysiwyg.php file until a patch is available.

Name of the Vulnerable Software and Affected Versions: Simple Image Gallery WordPress plugin versions up to and including 1.0.6 Description: The issue allows attackers to inject arbitrary web scripts via the `msg` parameter found in the ~/simple-image-gallery.php file, enabling Reflected Cross-Site Scripting attacks. Recommendations: For versions up to and including 1.0.6, consider disabling access to the ~/simple-image-gallery.php file or restricting the use of the `msg` parameter until a patch is available.

Name of the Vulnerable Software and Affected Versions: Parsian Bank Gateway for Woocommerce WordPress plugin versions up to and including 1.0 Description: The issue allows attackers to inject arbitrary web scripts due to a var dump() on $ POST variables found in the ~/vendor/dpsoft/parsian-payment/sample/rollback-payment.php file. This is a Reflected Cross-Site Scripting vulnerability via a parameter. Recommendations: For versions up to and including 1.0, update to a version that fixes this issue, as the current version allows for the injection of arbitrary web scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.