Omar Kurt

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in GET requests. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `c` parameter or `a` parameter.

The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters, including `banned word[]` to "/index.php/dashboard/system/conversations/bannedwords/success", `channel` to "/index.php/dashboard/reports/logs/view", `accessType` to "/index.php/tools/required/permissions/access entity", `msCountry` to "/index.php/dashboard/system/multilingual/setup/load icon", `arHandle` to "/index.php/ccm/system/dialogs/area/design/submit" or "/index.php/ccm/system/dialogs/area/design", `pageURL` to "/index.php/dashboard/pages/single", `SEARCH INDEX AREA METHOD` to "/index.php/dashboard/system/seo/searchindex/updated", `unit` to "/index.php/dashboard/system/optimization/jobs/job scheduled", `register notification email` to "/index.php/dashboard/system/registration/open/1", or `PATH INFO` to "/index.php/dashboard/extend/connect/".

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `banner effect divid` parameter in the BannerEffectOptions page to "wp-admin/options-general.php".

The issue allows remote attackers to inject arbitrary web script or HTML via the `cat` parameter in a "powerpress-editcategoryfeed" action in the "powerpressadmin categoryfeeds.php" page to "wp-admin/admin.php". This is a cross-site scripting (XSS) issue.

The issue allows remote attackers to inject arbitrary web script or HTML via the `forum name`, `forum group`, `forum icon`, or `forum desc` parameters in the bb admin.php file.