CVE-2024-53279 | ByteOS Network

Vulnerability Details :

CVE-2024-53279

Assigner-synology

Assigner Org ID-db201096-a0cc-46c7-9a55-61d9e221bf01

Published At-09 Dec, 2024 | 03:30

Updated At-01 Aug, 2025 | 05:23

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:synology

Assigner Org ID:db201096-a0cc-46c7-9a55-61d9e221bf01

Published At:09 Dec, 2024 | 03:30

Updated At:01 Aug, 2025 | 05:23

▼CVE Numbering Authority (CNA)

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

Affected Products

Vendor

Product

Synology Router Manager (SRM)

Default Status

affected

Versions

Affected

From 1.3 before 1.3.1-9346-10 (semver)

unknown

From 0 before 1.3 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Credits

finder

Only Hack in Cave (tr4ce(Jinho Ju), neko_hat(Dohwan Kim), tw0n3(Han Lee), Hc0wl(GangMin Kim)) (https://github.com/Team-OHiC)

References

Hyperlink	Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_24_09	vendor-advisory

Hyperlink: https://www.synology.com/en-global/security/advisory/Synology_SA_24_09

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security@synology.com

Published At:09 Dec, 2024 | 04:15

Updated At:04 Aug, 2025 | 19:08

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Type: Primary

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

CPE Matches

>>router_manager>>Versions from 1.3(inclusive) to 1.3.1-9346(exclusive)

cpe:2.3:o:synology:router_manager:*:*:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:-:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update1:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update2:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update3:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update4:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update5:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update6:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update7:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update8:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	security@synology.com

CWE ID: CWE-79

Type: Secondary

Source: security@synology.com

References

Hyperlink	Source	Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_24_09	security@synology.com	Vendor Advisory

Hyperlink: https://www.synology.com/en-global/security/advisory/Synology_SA_24_09

Source: security@synology.com

Resource:

Vendor Advisory

Similar CVEs

1110Records found

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.21% / 42.75%

||

7 Day CHG~0.00%

Published-21 Jun, 2024 | 12:40

Updated-02 Aug, 2024 | 03:14

WordPress WP Job Portal – A Complete Job Board plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Job Portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.1.3.

Vendor-WP Job Portal

Product-wp_job_portal WP Job Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Rockwell Automation

Matching Score-4

Assigner-Rockwell Automation

CVSS Score-4.7||MEDIUM

EPSS-0.08% / 23.62%

||

7 Day CHG~0.00%

Published-11 May, 2023 | 17:47

Updated-24 Jan, 2025 | 17:15

Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.

Vendor-Rockwell Automation, Inc.

Product-armorstart_st_281e armorstart_st_284ee_firmware armorstart_st_284ee armorstart_st_281e_firmware ArmorStart ST

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 24.27%

||

7 Day CHG~0.00%

Published-01 Jun, 2024 | 23:20

Updated-02 Aug, 2024 | 03:14

WordPress Smartarget Message Bar plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Smartarget Smartarget Message Bar allows Stored XSS.This issue affects Smartarget Message Bar: from n/a through 1.3.

Vendor-Smartarget

Product-Smartarget Message Bar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 23.96%

||

7 Day CHG~0.00%

Published-08 Jun, 2024 | 12:35

Updated-02 Aug, 2024 | 03:14

WordPress Woody code snippets plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10.

Vendor-cm-wp Creative Motion, Will Bontrager Software, LLC

Product-woody_code_snippets Woody ad snippets

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-26 Jun, 2023 | 05:05

Updated-10 Oct, 2024 | 17:12

WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin <= 2.1.48 versions.

Vendor-piwebsolution PI Websolution

Product-add-to-cart-direct-checkout-for-woocommerce Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 23.96%

||

7 Day CHG~0.00%

Published-08 Jun, 2024 | 10:24

Updated-02 Aug, 2024 | 03:14

WordPress Tooltip CK plugin <= 2.2.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CeiKay Tooltip CK tooltip-ck allows Stored XSS.This issue affects Tooltip CK: from n/a through 2.2.15.

Vendor-ceikay CeiKay

Product-tooltip_ck Tooltip CK

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 24.27%

||

7 Day CHG~0.00%

Published-01 Jun, 2024 | 23:16

Updated-02 Aug, 2024 | 03:14

WordPress Global Notification Bar plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Notification Bar allows Stored XSS.This issue affects Global Notification Bar: from n/a through 1.0.1.

Vendor-Global Notification Bar

Product-Global Notification Bar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 23.96%

||

7 Day CHG~0.00%

Published-08 Jun, 2024 | 12:52

Updated-02 Aug, 2024 | 03:14

WordPress YITH Custom Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YITH YITH Custom Login allows Stored XSS.This issue affects YITH Custom Login: from n/a through 1.7.0.

Vendor-Your Inspiration Solutions S.L.U. (YITH) (YITHEMES)

Product-yith_custom_login YITH Custom Login

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-23 Mar, 2023 | 11:45

Updated-10 Jan, 2025 | 19:18

WordPress Event Manager for WooCommerce Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.

Vendor-MagePeople

Product-event_manager_and_tickets_selling_for_woocommerce Event Manager and Tickets Selling Plugin for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-08 May, 2023 | 12:22

Updated-09 Jan, 2025 | 15:25

WordPress Easy Event calendar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CoreFortress Easy Event calendar plugin <= 1.0 versions.

Vendor-easy_event_calendar_project CoreFortress

Product-easy_event_calendar Easy Event calendar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-10 May, 2023 | 07:07

Updated-25 Feb, 2025 | 20:38

WordPress WPMobile.App Plugin <= 11.20 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.20 versions.

Vendor-amauri WPMobile.App

Product-wpmobile.app WPMobile.App — Android and iOS Mobile Application

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-22 Jun, 2023 | 08:24

Updated-10 Oct, 2024 | 17:25

WordPress SMTP2GO Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO – Email Made Easy plugin <= 1.4.2 versions.

Vendor-smtp2go SMTP2GO

Product-smtp2go SMTP2GO – Email Made Easy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.28% / 50.89%

||

7 Day CHG~0.00%

Published-09 May, 2024 | 11:22

Updated-02 Aug, 2024 | 02:51

WordPress Forty Four – 404 Plugin for WordPress plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpbits Forty Four – 404 Plugin for WordPress allows Stored XSS.This issue affects Forty Four – 404 Plugin for WordPress: from n/a through 1.4.

Vendor-phpbits

Product-Forty Four – 404 Plugin for WordPress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 24.27%

||

7 Day CHG~0.00%

Published-03 Jun, 2024 | 10:52

Updated-02 Aug, 2024 | 02:59

WordPress WP Next Post Navi plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kharim Tomlinson WP Next Post Navi allows Stored XSS.This issue affects WP Next Post Navi: from n/a through 1.8.3.

Vendor-Kharim Tomlinson

Product-WP Next Post Navi

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-22 Jun, 2023 | 12:25

Updated-10 Oct, 2024 | 17:21

WordPress Review Stream Plugin <= 1.6.5 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Grade Us, Inc. Review Stream plugin <= 1.6.5 versions.

Vendor-grade Grade Us, Inc.

Product-review_stream Review Stream

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 19.68%

||

7 Day CHG~0.00%

Published-08 Aug, 2023 | 12:25

Updated-19 Feb, 2025 | 21:26

WordPress WP Full Stripe Free Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions.

Vendor-paymentsplugin Mammothology

Product-wp_full_stripe_free WP Full Stripe Free

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.05% / 14.61%

||

7 Day CHG~0.00%

Published-17 Aug, 2023 | 21:19

Updated-19 Feb, 2025 | 21:26

WordPress WP BrowserUpdate Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.5 versions.

Vendor-marcosteinbrecher Marco Steinbrecher

Product-wp_browserupdate WP BrowserUpdate

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.16% / 37.93%

||

7 Day CHG~0.00%

Published-13 May, 2024 | 08:36

Updated-19 Mar, 2025 | 18:52

WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.5.1.

Vendor-veronalabs VeronaLabs veronalabs

Product-wp_sms WP SMS wp_sms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.10% / 28.47%

||

7 Day CHG~0.00%

Published-09 May, 2024 | 11:29

Updated-02 Aug, 2024 | 02:51

WordPress Comments Evolved for WordPress plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in talspotim Comments Evolved for WordPress allows Stored XSS.This issue affects Comments Evolved for WordPress: from n/a through 1.6.3.

Vendor-talspotim

Product-Comments Evolved for WordPress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.05% / 16.39%

||

7 Day CHG~0.00%

Published-17 Aug, 2023 | 08:04

Updated-25 Sep, 2024 | 16:43

WordPress Cab Grid Plugin <= 1.5.15 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in M Williams Cab Grid plugin <= 1.5.15 versions.

Vendor-nimbus M Williams

Product-cab_grid Cab Grid

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-22 Jun, 2023 | 11:34

Updated-10 Oct, 2024 | 17:24

WordPress Pagination by BestWebSoft Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Pagination plugin <= 1.2.2 versions.

Vendor-BestWebSoft

Product-pagination Pagination

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-12 May, 2023 | 15:10

Updated-09 Jan, 2025 | 15:17

WordPress ApexChat Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ApexChat plugin <= 1.3.1 versions.

Vendor-apexchat ApexChat

Product-apexchat ApexChat

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-22 Jun, 2023 | 08:37

Updated-10 Oct, 2024 | 17:25

WordPress VigilanTor Plugin <= 1.3.10 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Drew Phillips VigilanTor plugin <= 1.3.10 versions.

Vendor-vigilantor_project Drew Phillips

Product-vigilantor VigilanTor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-23 Jun, 2023 | 12:26

Updated-19 Feb, 2025 | 21:28

WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.

Vendor-wpmet Wpmet

Product-wp_ultimate_review Wp Ultimate Review

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.28% / 50.89%

||

7 Day CHG~0.00%

Published-09 May, 2024 | 11:15

Updated-02 Aug, 2024 | 02:51

WordPress AWSOM News Announcement plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harknell AWSOM News Announcement allows Stored XSS.This issue affects AWSOM News Announcement: from n/a through 1.6.0.

Vendor-Harknell harknell

Product-AWSOM News Announcement awsom_news_announcement

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.16% / 37.45%

||

7 Day CHG~0.00%

Published-08 May, 2024 | 11:09

Updated-02 Aug, 2024 | 02:59

WordPress Real3D Flipbook PDF Viewer Lite plugin <= 3.71 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Stored XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.71.

Vendor-Creative interactive media

Product-3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.10% / 28.47%

||

7 Day CHG~0.00%

Published-06 May, 2024 | 20:14

Updated-02 Aug, 2024 | 02:51

WordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: from n/a through 1.1.10.

Vendor-SliceWP

Product-SliceWP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 19.09%

||

7 Day CHG~0.00%

Published-22 Jun, 2023 | 11:59

Updated-10 Oct, 2024 | 17:22

WordPress eRocket Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in eLightUp eRocket plugin <= 1.2.4 versions.

Vendor-elightup eLightUp

Product-erocket eRocket

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 12.05%

||

7 Day CHG~0.00%

Published-17 Aug, 2023 | 14:50

Updated-25 Sep, 2024 | 14:48

WordPress Woocommerce Tip/Donation Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (shop manager+) Stored Cross-Site Scripting (XSS) vulnerability in PHPRADAR Woocommerce Tip/Donation plugin <= 1.2 versions.

Vendor-phpradar PHPRADAR

Product-woocommerce_tip\/donation Woocommerce Tip/Donation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.28% / 50.74%

||

7 Day CHG~0.00%

Published-09 May, 2024 | 11:17

Updated-02 Aug, 2024 | 02:51

WordPress QuickieBar plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Baylog QuickieBar allows Stored XSS.This issue affects QuickieBar: from n/a through 1.8.4.

Vendor-Phil Baylog

Product-QuickieBar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 19.68%

||

7 Day CHG~0.00%

Published-08 Aug, 2023 | 12:35

Updated-25 Sep, 2024 | 16:47

WordPress Post Connector Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Never5 Post Connector plugin <= 1.0.9 versions.

Vendor-never5 Never5

Product-post_connector Post Connector

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 24.27%

||

7 Day CHG~0.00%

Published-16 May, 2024 | 15:54

Updated-02 Aug, 2024 | 02:59

WordPress Magazine Blocks plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPBlockart Magazine Blocks allows Stored XSS.This issue affects Magazine Blocks: from n/a through 1.3.6.

Vendor-WPBlockart

Product-Magazine Blocks

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-30 Aug, 2023 | 15:27

Updated-19 Feb, 2025 | 21:25

WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.3 versions.

Vendor-kevonadonis Kevon Adonis

Product-wp_abstracts WP Abstracts

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-30 Aug, 2023 | 15:58

Updated-24 Sep, 2024 | 19:08

WordPress Livestream Notice Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MrDemonWolf Livestream Notice plugin <= 1.2.0 versions.

Vendor-mrdemonwolf MrDemonWolf

Product-livestream_notice Livestream Notice

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.19% / 40.65%

||

7 Day CHG~0.00%

Published-09 May, 2024 | 11:33

Updated-02 Aug, 2024 | 02:51

WordPress Viet Nam Affiliate plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toidicode.Com (thanhtaivtt) Viet Nam Affiliate allows Stored XSS.This issue affects Viet Nam Affiliate: from n/a through 1.0.0.

Vendor-Toidicode.com (thanhtaivtt)toidicode.com

Product-Viet Nam Affiliate viet_nam_affiliate

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-13 Jun, 2023 | 14:12

Updated-01 Nov, 2024 | 14:02

WordPress Chat Bee Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kamyabsoft Chat Bee plugin <= 1.1.0 versions.

Vendor-chat_bee_project Kamyabsoft

Product-chat_bee Chat Bee

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.17% / 38.48%

||

7 Day CHG~0.00%

Published-08 May, 2024 | 11:33

Updated-02 Aug, 2024 | 02:59

WordPress Sticky Social Link plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HabibCoder Sticky Social Link allows Stored XSS.This issue affects Sticky Social Link: from n/a through 1.0.0.

Vendor-HabibCoder

Product-Sticky Social Link

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-08 Aug, 2023 | 10:15

Updated-25 Sep, 2024 | 16:51

WordPress NS Coupon to Become Customer Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NsThemes NS Coupon To Become Customer plugin <= 1.2.2 versions.

Vendor-nsthemes NsThemes

Product-ns_coupon_to_become_customer NS Coupon To Become Customer

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.10% / 28.17%

||

7 Day CHG~0.00%

Published-09 May, 2024 | 11:03

Updated-02 Aug, 2024 | 02:51

WordPress Form Maker by 10Web plugin <= 1.15.24 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.24.

Vendor-10Web (TenWeb, Inc.)

Product-Form Maker by 10Web

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-22 Jun, 2023 | 08:33

Updated-02 Aug, 2024 | 12:16

WordPress Store Locator WordPress Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS)

Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in AGILELOGIX Store Locator WordPress plugin <= 1.4.9 versions.

Vendor-Agile Logix

Product-store_locator Store Locator WordPress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.16% / 37.45%

||

7 Day CHG~0.00%

Published-08 May, 2024 | 10:57

Updated-02 Aug, 2024 | 02:59

WordPress Debug Info plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debug Info allows Stored XSS.This issue affects Debug Info: from n/a through 1.3.10.

Vendor-AMP-MODE

Product-Debug Info

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-21 Jun, 2023 | 12:57

Updated-10 Oct, 2024 | 18:12

WordPress New Adman Plugin <= 1.6.8 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gl_SPICE New Adman plugin <= 1.6.8 versions.

Vendor-new_adman_project gl_SPICE

Product-new_adman New Adman

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-23 Apr, 2023 | 10:47

Updated-02 Aug, 2024 | 13:44

WordPress Electric Studio Client Login Plugin <= 0.8.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in James Irving-Swift Electric Studio Client Login plugin <= 0.8.1 versions.

Vendor-electric_studio_client_login_project James Irving-Swift

Product-electric_studio_client_login Electric Studio Client Login

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-23 Apr, 2023 | 10:54

Updated-09 Jan, 2025 | 15:37

WordPress Motor Racing League Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Ian Haycox Motor Racing League plugin <= 1.9.9 versions.

Vendor-motor_racing_league_project Ian Haycox

Product-motor_racing_league Motor Racing League

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.28% / 50.89%

||

7 Day CHG~0.00%

Published-09 May, 2024 | 11:12

Updated-02 Aug, 2024 | 02:51

WordPress TT Custom Post Type Creator plugin <=1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rashed Latif TT Custom Post Type Creator allows Stored XSS.This issue affects TT Custom Post Type Creator: from n/a through 1.0.

Vendor-Rashed Latif

Product-TT Custom Post Type Creator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.17% / 38.10%

||

7 Day CHG~0.00%

Published-08 May, 2024 | 10:37

Updated-02 Aug, 2024 | 02:59

WordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.3.

Vendor-Xpro

Product-Xpro Elementor Addons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.28% / 50.89%

||

7 Day CHG~0.00%

Published-09 May, 2024 | 11:16

Updated-02 Aug, 2024 | 02:51

WordPress Brozzme Scroll Top plugin <= 1.8.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benoti Brozzme Scroll Top allows Stored XSS.This issue affects Brozzme Scroll Top: from n/a through 1.8.5.

Vendor-Benoti

Product-Brozzme Scroll Top

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.06%

||

7 Day CHG~0.00%

Published-23 Jun, 2023 | 12:21

Updated-10 Oct, 2024 | 17:12

WordPress CRM Memberships Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NTZApps CRM Memberships plugin <= 1.6 versions.

Vendor-ntzapps NTZApps

Product-crm_memberships CRM Memberships

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-5.9||MEDIUM

EPSS-0.09% / 25.98%

||

7 Day CHG~0.00%

Published-13 Jul, 2024 | 06:00

Updated-13 May, 2025 | 13:48

Product Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSS

The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Vendor-wisdmlabs Unknown gravitymaster

Product-product_enquiry_for_woocommerce Product Enquiry for WooCommerce product_enquiry_for_woocommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.12% / 31.64%

||

7 Day CHG~0.00%

Published-01 Aug, 2024 | 21:56

Updated-11 Aug, 2025 | 17:45

WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 4.0.5.

Vendor-themewinter Themewinter

Product-eventin Eventin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')