Uko

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `jsticket message` parameter. The issue is triggered when an administrator or agent opens a ticket and the page initializes VenoBox, which reads the browser-decoded data-title attribute and passes it to the jQuery `.html()` function, executing arbitrary web scripts.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the `note` parameter, which is a form field whose value is written to post meta `note`. These scripts execute when a user accesses the affected page. Exploitation requires a privileged user with the `edit others posts` capability to visit a specific form URL containing a post ID created by the attacker, typically delivered via a phishing link.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the `tpro client image (JPEG IPTC caption) + tpro client testimonial ([gallery] shortcode)` parameter. These scripts execute when a user accesses the affected page. Exploitation requires an administrator to have approved the submitted testimonials and to have the display block configured with the Strip All HTML Tags option disabled, which is the default setting for rendering formatted content.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue exists via the `tpro client name` parameter. Exploitation occurs when an administrator publishes a submitted testimonial, triggers the Show Preview AJAX handler, and saves an Update, which persists the payload as the Manage View title. This process requires administrative action to execute the injected scripts on pages accessed by users.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `post[body]` parameter, which then execute when a user visits the affected page.

An unauthenticated time-based SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to extract sensitive information from the database. The attack targets the `href[locale]` parameter. The required nonce is publicly available to unauthenticated visitors on any forum page via the `wpforo.nonces` JavaScript object, requiring only a page load for acquisition.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the `pm note` parameter (or any custom Textarea metakey with HTML disabled), enabling the injection of arbitrary web scripts. Exploitation requires a privileged user to click an attacker-rendered anchor on a target profile page, which triggers a DOM gadget that concatenates the unescaped `data-src` value into an HTML string processed by jQuery.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `comment` parameter. Exploitation requires a secondary language to be configured in the plugin and at least one prior comment from the attacker's name and email pair to be approved under the default WordPress `comment previously approved` moderation setting.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `url (comment author url)` parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. Exploitation requires the page to be configured with a GreenShift Interaction Layer attach-attribute action that copies a comment-author anchor's href into a Counter block's `data-prefix` or `data-postfix` attribute. Once the comment is published, the payload executes for every visitor who loads the Counter into the viewport.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts via the `answer[]` parameter. This requires the attacker to be enrolled as a student in a course with a Content-type quiz question. The injected script executes in the administrator's browser session during the grading workflow when the 'Start a Review' action is triggered for the affected attempt.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `comment` parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Successful exploitation requires the site to use Shutter or Shutter Reloaded as the active lightbox, and the injected content must be approved through the standard WordPress moderation workflow.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `user-submitted-content` parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. While default installations require admin approval for pending posts, enabling the publish immediately option allows the payload to become live without moderator interaction.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts via the `comment` parameter. These scripts execute when a user accesses a page where the injected comment is visible and the SureCart web-component bundle is loaded, such as a page containing a SureCart Buy Button block. Execution depends on the comment being auto-approved or approved by a moderator.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `comment` parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Exploitation requires a specific configuration where an administrator has published a page containing a Text Animated block with Content set to Blocks, a nested Latest Comments block with excerpts enabled, and at least one Animated Texts value configured, which triggers the `gs-textanimate` script to process the comment excerpts.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the `comment` parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Exploitation requires a specific configuration where an Advanced HTML Element block with Split Text animation enabled wraps a Latest Comments block that displays comment excerpts, causing the `splittext.js` file to process the comment content container.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `user url` parameter, enabling the injection of arbitrary web scripts into pages. These scripts execute when a user visits the affected page, specifically when clicking the attacker's Website URL link on their public profile. This is facilitated by the redirect-confirmation onclick handler, which is enabled by default on new installations.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a malicious filename is supplied to the `ppress billing address` file upload field via a crafted POST request on any page hosting the ProfilePress Tabbed Widget. If a user is tricked into clicking a malicious link, arbitrary web scripts can be executed in their browser.

A path traversal and arbitrary file write issue exists in the `get` function within the ' main .py' file. The issue allows unauthorized access and modification of files.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page.

The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting (XSS). This means an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised pages. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.