CVE-2024-53279 | ByteOS Network

Vulnerability Details :

CVE-2024-53279

Assigner-synology

Assigner Org ID-db201096-a0cc-46c7-9a55-61d9e221bf01

Published At-09 Dec, 2024 | 03:30

Updated At-01 Aug, 2025 | 05:23

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:synology

Assigner Org ID:db201096-a0cc-46c7-9a55-61d9e221bf01

Published At:09 Dec, 2024 | 03:30

Updated At:01 Aug, 2025 | 05:23

▼CVE Numbering Authority (CNA)

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

Affected Products

Vendor

Product

Synology Router Manager (SRM)

Default Status

affected

Versions

Affected

From 1.3 before 1.3.1-9346-10 (semver)

unknown

From 0 before 1.3 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Credits

finder

Only Hack in Cave (tr4ce(Jinho Ju), neko_hat(Dohwan Kim), tw0n3(Han Lee), Hc0wl(GangMin Kim)) (https://github.com/Team-OHiC)

References

Hyperlink	Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_24_09	vendor-advisory

Hyperlink: https://www.synology.com/en-global/security/advisory/Synology_SA_24_09

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security@synology.com

Published At:09 Dec, 2024 | 04:15

Updated At:04 Aug, 2025 | 19:08

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Type: Primary

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

CPE Matches

>>router_manager>>Versions from 1.3(inclusive) to 1.3.1-9346(exclusive)

cpe:2.3:o:synology:router_manager:*:*:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:-:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update1:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update2:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update3:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update4:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update5:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update6:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update7:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update8:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	security@synology.com

CWE ID: CWE-79

Type: Secondary

Source: security@synology.com

References

Hyperlink	Source	Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_24_09	security@synology.com	Vendor Advisory

Hyperlink: https://www.synology.com/en-global/security/advisory/Synology_SA_24_09

Source: security@synology.com

Resource:

Vendor Advisory

Similar CVEs

1110Records found

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.12% / 32.00%

||

7 Day CHG~0.00%

Published-24 Oct, 2023 | 11:10

Updated-10 Sep, 2024 | 17:56

WordPress CPT Shortcode Generator Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions.

Vendor-anuragdeshmukh Anurag Deshmukh

Product-cpt_shortcode_generator CPT Shortcode Generator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-27 Oct, 2023 | 07:27

Updated-09 Sep, 2024 | 14:36

WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions.

Vendor-bala-krishna Bala Krishna, Sergey Yakovlev

Product-category_seo_meta_tags Category SEO Meta Tags

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.14% / 33.95%

||

7 Day CHG~0.00%

Published-24 Oct, 2023 | 11:58

Updated-09 Sep, 2024 | 14:44

WordPress Scroll post excerpt Plugin <= 8.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Scroll post excerpt plugin <= 8.0 versions.

Vendor-gopiplus Gopi Ramasamy

Product-scroll_post_excerpt Scroll post excerpt

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-27 Oct, 2023 | 07:36

Updated-06 Sep, 2024 | 18:44

WordPress Webmaster Tools Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LionScripts.Com Webmaster Tools plugin <= 2.0 versions.

Vendor-lionscripts LionScripts.com

Product-webmaster_tools Webmaster Tools

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:03

Updated-23 Jun, 2025 | 20:16

WordPress File Manager Pro plugin <= 1.8.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro allows Stored XSS. This issue affects File Manager Pro: from n/a through 1.8.8.

Vendor-NinjaTeam

Product-File Manager Pro

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 8.83%

||

7 Day CHG~0.00%

Published-16 Jul, 2025 | 10:36

Updated-16 Jul, 2025 | 14:58

WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nanbu Welcart e-Commerce allows Stored XSS. This issue affects Welcart e-Commerce: from n/a through 2.11.16.

Vendor-nanbu

Product-Welcart e-Commerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-OpenText (formerly Micro Focus)

Matching Score-4

Assigner-OpenText (formerly Micro Focus)

CVSS Score-5.9||MEDIUM

EPSS-0.05% / 16.28%

||

7 Day CHG~0.00%

Published-09 Dec, 2023 | 01:52

Updated-04 Aug, 2024 | 15:40

Micro Focus ArcSight Management Center Remote Vulnerability

A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cross-Site Scripting (XSS).

Vendor-Micro Focus International Limited

Product-arcsight_management_center ArcSight Management Center

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 8.83%

||

7 Day CHG~0.00%

Published-27 Jun, 2025 | 13:21

Updated-30 Jun, 2025 | 18:38

WordPress Quick Favicon plugin <= 0.22.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Cummings Quick Favicon allows Stored XSS. This issue affects Quick Favicon: from n/a through 0.22.8.

Vendor-Robert Cummings

Product-Quick Favicon

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.07% / 21.52%

||

7 Day CHG~0.00%

Published-02 Oct, 2023 | 10:33

Updated-20 Sep, 2024 | 18:36

WordPress Onclick Show Popup Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Onclick show popup plugin <= 8.1 versions.

Vendor-gopiplus Gopi Ramasamy

Product-onclick_show_popup Onclick show popup

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.14% / 33.95%

||

7 Day CHG~0.00%

Published-24 Oct, 2023 | 12:12

Updated-19 Feb, 2025 | 21:20

WordPress WP GoToWebinar Plugin <= 14.45 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson WP GoToWebinar plugin <= 14.45 versions.

Vendor-northernbeacheswebsites Martin Gibson

Product-gotowebinar WP GoToWebinar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.14% / 33.95%

||

7 Day CHG~0.00%

Published-24 Oct, 2023 | 11:44

Updated-10 Sep, 2024 | 17:44

WordPress Amministrazione Trasparente Plugin <= 8.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Amministrazione Trasparente plugin <= 8.0.2 versions.

Vendor-amministrazione_trasparente_project Marco Milesi

Product-amministrazione_trasparente Amministrazione Trasparente

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.14% / 33.95%

||

7 Day CHG~0.00%

Published-24 Oct, 2023 | 12:00

Updated-09 Sep, 2024 | 21:01

WordPress Simple Tweet Plugin <= 1.4.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wokamoto Simple Tweet plugin <= 1.4.0.2 versions.

Vendor-wokamoto Wokamoto

Product-simple_tweet Simple Tweet

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.14% / 33.95%

||

7 Day CHG~0.00%

Published-24 Oct, 2023 | 12:28

Updated-09 Sep, 2024 | 21:00

WordPress LeadSquared Suite Plugin <= 0.7.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LeadSquared Suite plugin <= 0.7.4 versions.

Vendor-leadsquared LeadSquared, Inc

Product-leadsquared_suite LeadSquared Suite

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 8.83%

||

7 Day CHG~0.00%

Published-27 Jun, 2025 | 13:21

Updated-30 Jun, 2025 | 18:38

WordPress WP Edit plugin <= 4.0.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh WP Edit allows Stored XSS. This issue affects WP Edit: from n/a through 4.0.4.

Vendor-Josh

Product-WP Edit

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-26 Oct, 2023 | 12:23

Updated-19 Feb, 2025 | 21:19

WordPress WP Full Stripe Free Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions.

Vendor-paymentsplugin Mammothology

Product-wp_full_stripe_free WP Full Stripe Free

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-27 Oct, 2023 | 07:42

Updated-06 Sep, 2024 | 18:45

WordPress Internal Link Building Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions.

Vendor-internetmarketingninjas Internet Marketing Ninjas

Product-internal_link_building Internal Link Building

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-18 Oct, 2023 | 08:02

Updated-12 Sep, 2024 | 19:40

WordPress Image vertical reel scroll slideshow Plugin <= 9.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions.

Vendor-gopiplus Gopi Ramasamy

Product-image_vertical_reel_scroll_slideshow Image vertical reel scroll slideshow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-18 Oct, 2023 | 08:18

Updated-12 Sep, 2024 | 19:36

WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions.

Vendor-hitsteps Hitsteps

Product-web_analytics Hitsteps Web Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-18 Oct, 2023 | 12:43

Updated-12 Sep, 2024 | 18:23

WordPress Order auto complete for WooCommerce Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions.

Vendor-order_auto_complete_for_woocommerce_project Kardi

Product-order_auto_complete_for_woocommerce Order auto complete for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.12% / 31.02%

||

7 Day CHG~0.00%

Published-16 Oct, 2023 | 10:50

Updated-16 Sep, 2024 | 14:35

WordPress Abandoned Cart Lite for WooCommerce Plugin <= 5.15.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Abandoned Cart Lite for WooCommerce plugin <= 5.15.2 versions.

Vendor-tychesoftwares Tyche Softwares

Product-abandoned_cart_lite_for_woocommerce Abandoned Cart Lite for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.12% / 31.02%

||

7 Day CHG~0.00%

Published-16 Oct, 2023 | 10:29

Updated-13 Sep, 2024 | 19:39

WordPress Tiny Carousel Horizontal Slider Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny Carousel Horizontal Slider plugin <= 8.1 versions.

Vendor-gopiplus Gopi Ramasamy

Product-tiny_carosel_horizontal_slider Tiny Carousel Horizontal Slider

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-02 Oct, 2023 | 09:55

Updated-20 Sep, 2024 | 15:59

WordPress Blocks Plugin <= 1.6.41 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Renzo Johnson Blocks plugin <= 1.6.41 versions.

Vendor-renzojohnson Renzo Johnson

Product-blocks Blocks

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 19.73%

||

7 Day CHG~0.00%

Published-02 Oct, 2023 | 10:26

Updated-19 Feb, 2025 | 21:22

WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jewel Theme WP Adminify plugin <= 3.1.6 versions.

Vendor-wpadminify Jewel Theme

Product-wp_adminify WP Adminify

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-18 Oct, 2023 | 07:53

Updated-12 Sep, 2024 | 19:41

WordPress Comment Reply Email Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions.

Vendor-wpjohnny WPJohnny

Product-comment_reply_email Comment Reply Email

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-18 Oct, 2023 | 08:14

Updated-12 Sep, 2024 | 19:36

WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.

Vendor-100plugins 100plugins

Product-open_user_map Open User Map

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-02 Oct, 2023 | 09:30

Updated-20 Sep, 2024 | 15:33

WordPress WWM Social Share On Image Hover Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jobin Jose WWM Social Share On Image Hover plugin <= 2.2 versions.

Vendor-walkswithme Jobin Jose

Product-social_share_on_image_hover WWM Social Share On Image Hover

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.03% / 7.80%

||

7 Day CHG~0.00%

Published-14 Aug, 2025 | 18:21

Updated-15 Aug, 2025 | 13:12

WordPress RSS Feed Pro Plugin <= 1.1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artiosmedia RSS Feed Pro allows Stored XSS. This issue affects RSS Feed Pro: from n/a through 1.1.8.

Vendor-artiosmedia

Product-RSS Feed Pro

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-02 Oct, 2023 | 10:17

Updated-20 Sep, 2024 | 18:36

WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Popup contact form plugin <= 7.1 versions.

Vendor-gopiplus Gopi Ramasamy

Product-popup_contact_form Popup contact form

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2023 | 10:55

Updated-13 Sep, 2024 | 18:05

WordPress Complete Open Graph Plugin <= 3.4.5 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex MacArthur Complete Open Graph plugin <= 3.4.5 versions.

Vendor-Alex MacArthur

Product-complete_open_graph Complete Open Graph

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:03

Updated-24 Jun, 2025 | 13:34

WordPress ATP Call Now plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Truong Thanh ATP Call Now allows Stored XSS. This issue affects ATP Call Now: from n/a through 1.0.3.

Vendor-Truong Thanh

Product-ATP Call Now

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:03

Updated-23 Jun, 2025 | 20:16

WordPress Better Random Redirect plugin <= 1.3.20 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Better Random Redirect allows Stored XSS. This issue affects Better Random Redirect: from n/a through 1.3.20.

Vendor-Robert Peake

Product-Better Random Redirect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.03% / 7.80%

||

7 Day CHG~0.00%

Published-20 Aug, 2025 | 08:03

Updated-20 Aug, 2025 | 14:39

WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rewish WP Emmet allows Stored XSS. This issue affects WP Emmet: from n/a through 0.3.4.

Vendor-rewish

Product-WP Emmet

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:03

Updated-23 Jun, 2025 | 20:16

WordPress Tealium plugin <= 2.1.17 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tealium Tealium allows Stored XSS. This issue affects Tealium: from n/a through 2.1.17.

Vendor-Tealium

Product-Tealium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.03% / 7.80%

||

7 Day CHG~0.00%

Published-20 Aug, 2025 | 08:03

Updated-20 Aug, 2025 | 17:51

WordPress Pending Order Bot plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in badasswp Pending Order Bot allows Stored XSS. This issue affects Pending Order Bot: from n/a through 1.0.2.

Vendor-badasswp

Product-Pending Order Bot

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-02 Oct, 2023 | 10:14

Updated-20 Sep, 2024 | 17:27

WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Popup contact form plugin <= 7.1 versions.

Vendor-gopiplus Gopi Ramasamy

Product-popup_contact_form Popup contact form

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-02 Oct, 2023 | 09:37

Updated-20 Sep, 2024 | 15:33

WordPress Social Metrics Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Riyaz Social Metrics plugin <= 2.2 versions.

Vendor-riyaz Riyaz

Product-social_metrics Social Metrics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.12% / 31.02%

||

7 Day CHG~0.00%

Published-16 Oct, 2023 | 11:01

Updated-13 Sep, 2024 | 19:38

WordPress Timely Booking Button Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Timely - Appointment software Timely Booking Button plugin <= 2.0.2 versions.

Vendor-gettimely Timely - Appointment software

Product-timely_booking_button Timely Booking Button

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-17 Jun, 2025 | 15:01

Updated-20 Jun, 2025 | 13:13

WordPress Noptin plugin <= 3.8.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Mutende Noptin allows Stored XSS. This issue affects Noptin: from n/a through 3.8.7.

Vendor-Brian Mutende

Product-Noptin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-18 Oct, 2023 | 12:51

Updated-12 Sep, 2024 | 18:14

WordPress Mendeley Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions.

Vendor-kochm Michael Koch

Product-mendeley_plugin Mendeley Plugin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:04

Updated-23 Jun, 2025 | 20:16

WordPress CSV Importer Improved plugin <= 0.6.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Judge CSV Importer Improved allows Stored XSS. This issue affects CSV Importer Improved: from n/a through 0.6.1.

Vendor-Jason Judge

Product-CSV Importer Improved

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:03

Updated-23 Jun, 2025 | 20:16

WordPress WP Voting Contest plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt WP Voting Contest allows Stored XSS. This issue affects WP Voting Contest: from n/a through 5.8.

Vendor-Matt

Product-WP Voting Contest

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-17 Jun, 2025 | 15:01

Updated-18 Jun, 2025 | 16:27

WordPress Ebook Store plugin <= 5.8008 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store allows Stored XSS. This issue affects Ebook Store: from n/a through 5.8008.

Vendor-motov.net

Product-Ebook Store

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:04

Updated-23 Jun, 2025 | 20:16

WordPress plugin Recipes manager - WPH <=1.0.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. This issue affects Recipes manager - WPH: from n/a through 1.0.4.

Vendor-Félix Martínez

Product-Recipes manager - WPH

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:03

Updated-23 Jun, 2025 | 20:16

WordPress WP-FB-AutoConnect plugin <= 4.6.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in justin_k WP-FB-AutoConnect allows Stored XSS. This issue affects WP-FB-AutoConnect: from n/a through 4.6.3.

Vendor-justin_k

Product-WP-FB-AutoConnect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.03% / 7.80%

||

7 Day CHG~0.00%

Published-20 Aug, 2025 | 08:03

Updated-20 Aug, 2025 | 17:52

WordPress Contact Info Widget plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in riotweb Contact Info Widget allows Stored XSS. This issue affects Contact Info Widget: from n/a through 2.6.2.

Vendor-riotweb

Product-Contact Info Widget

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:03

Updated-24 Jun, 2025 | 13:35

WordPress Spoki plugin <= 2.16.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spoki Spoki allows Stored XSS. This issue affects Spoki: from n/a through 2.16.0.

Vendor-spoki

Product-Spoki

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.09%

||

7 Day CHG~0.00%

Published-02 Oct, 2023 | 08:13

Updated-19 Feb, 2025 | 21:22

WordPress WP Jump Menu Plugin <= 3.6.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jim Krill WP Jump Menu plugin <= 3.6.4 versions.

Vendor-krillwebdesign Jim Krill

Product-wp-jump-menu WP Jump Menu

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:04

Updated-23 Jun, 2025 | 20:16

WordPress PDPA Consent for Thailand plugin <= 1.1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan PDPA Consent for Thailand allows Stored XSS. This issue affects PDPA Consent for Thailand: from n/a through 1.1.1.

Vendor-iamapinan

Product-PDPA Consent for Thailand

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.03% / 7.80%

||

7 Day CHG~0.00%

Published-20 Aug, 2025 | 08:03

Updated-20 Aug, 2025 | 17:54

WordPress AWStats Script plugin <= 0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jorge Garcia de Bustos AWStats Script allows Stored XSS. This issue affects AWStats Script: from n/a through 0.3.

Vendor-Jorge Garcia de Bustos

Product-AWStats Script

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.62%

||

7 Day CHG+0.01%

Published-20 Jun, 2025 | 15:03

Updated-23 Jun, 2025 | 20:16

WordPress RDFa Breadcrumb plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitin Yawalkar RDFa Breadcrumb allows Stored XSS. This issue affects RDFa Breadcrumb: from n/a through 2.3.

Vendor-Nitin Yawalkar

Product-RDFa Breadcrumb

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')