CVE-2024-53279 | ByteOS Network

Vulnerability Details :

CVE-2024-53279

Assigner-synology

Assigner Org ID-db201096-a0cc-46c7-9a55-61d9e221bf01

Published At-09 Dec, 2024 | 03:30

Updated At-01 Aug, 2025 | 05:23

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:synology

Assigner Org ID:db201096-a0cc-46c7-9a55-61d9e221bf01

Published At:09 Dec, 2024 | 03:30

Updated At:01 Aug, 2025 | 05:23

▼CVE Numbering Authority (CNA)

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

Affected Products

Vendor

Product

Synology Router Manager (SRM)

Default Status

affected

Versions

Affected

From 1.3 before 1.3.1-9346-10 (semver)

unknown

From 0 before 1.3 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Credits

finder

Only Hack in Cave (tr4ce(Jinho Ju), neko_hat(Dohwan Kim), tw0n3(Han Lee), Hc0wl(GangMin Kim)) (https://github.com/Team-OHiC)

References

Hyperlink	Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_24_09	vendor-advisory

Hyperlink: https://www.synology.com/en-global/security/advisory/Synology_SA_24_09

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security@synology.com

Published At:09 Dec, 2024 | 04:15

Updated At:04 Aug, 2025 | 19:08

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Type: Primary

Version: 3.1

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

CPE Matches

>>router_manager>>Versions from 1.3(inclusive) to 1.3.1-9346(exclusive)

cpe:2.3:o:synology:router_manager:*:*:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:-:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update1:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update2:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update3:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update4:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update5:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update6:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update7:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update8:*:*:*:*:*:*

>>router_manager>>1.3.1-9346

cpe:2.3:o:synology:router_manager:1.3.1-9346:update9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	security@synology.com

CWE ID: CWE-79

Type: Secondary

Source: security@synology.com

References

Hyperlink	Source	Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_24_09	security@synology.com	Vendor Advisory

Hyperlink: https://www.synology.com/en-global/security/advisory/Synology_SA_24_09

Source: security@synology.com

Resource:

Vendor Advisory

Similar CVEs

1110Records found

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.66%

||

7 Day CHG~0.00%

Published-07 May, 2025 | 14:20

Updated-08 May, 2025 | 15:35

WordPress Email Notification on Login <= 1.6.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Email Notification on Login allows Stored XSS. This issue affects Email Notification on Login: from n/a through 1.6.1.

Vendor-apasionados

Product-Email Notification on Login

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.66%

||

7 Day CHG~0.00%

Published-07 May, 2025 | 14:20

Updated-08 May, 2025 | 14:39

WordPress Quran multilanguage Text & Audio <= 2.3.23 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karim42 Quran multilanguage Text & Audio allows Stored XSS. This issue affects Quran multilanguage Text & Audio: from n/a through 2.3.23.

Vendor-karim42

Product-Quran multilanguage Text & Audio

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress Blog Manager WP <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Blog Manager WP allows Stored XSS. This issue affects Blog Manager WP: from n/a through 1.0.5.

Vendor-wpdiscover

Product-Blog Manager WP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress COVID-19 (Coronavirus) Update Your Customers <= 1.5.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devignstudiosltd COVID-19 (Coronavirus) Update Your Customers allows Stored XSS. This issue affects COVID-19 (Coronavirus) Update Your Customers: from n/a through 1.5.1.

Vendor-devignstudiosltd

Product-COVID-19 (Coronavirus) Update Your Customers

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.10%

||

7 Day CHG~0.00%

Published-03 Sep, 2023 | 11:13

Updated-24 Sep, 2024 | 18:57

WordPress Elastic Email Sender Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <= 1.2.6 versions.

Vendor-elasticemail Elastic Email Sender

Product-elastic_email_sender Elastic Email Sender

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress WP-reCAPTCHA-bp <= 4.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elrata_ WP-reCAPTCHA-bp allows Stored XSS. This issue affects WP-reCAPTCHA-bp: from n/a through 4.1.

Vendor-elrata_

Product-WP-reCAPTCHA-bp

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.05% / 14.51%

||

7 Day CHG~0.00%

Published-22 Apr, 2025 | 09:53

Updated-30 Apr, 2025 | 16:33

WordPress Textmetrics <= 3.6.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Israpil Textmetrics allows Stored XSS. This issue affects Textmetrics: from n/a through 3.6.2.

Vendor-textmetrics Israpil

Product-textmetrics Textmetrics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.05% / 14.51%

||

7 Day CHG~0.00%

Published-22 Apr, 2025 | 09:53

Updated-30 Apr, 2025 | 15:22

WordPress VForm <= 3.1.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VForm allows Stored XSS. This issue affects VForm: from n/a through 3.1.14.

Vendor-vikasratudi Vikas Ratudi

Product-lifetime_free_drag_\&_drop_contact_form_builder VForm

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress WP Cookie Consent <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in msmitley WP Cookie Consent allows Stored XSS. This issue affects WP Cookie Consent: from n/a through 1.0.

Vendor-msmitley

Product-WP Cookie Consent

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress Business Contact Widget <= 2.7.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StressFree Sites Business Contact Widget allows Stored XSS. This issue affects Business Contact Widget: from n/a through 2.7.0.

Vendor-StressFree Sites

Product-Business Contact Widget

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress Landing pages and Domain aliases for WordPress <= 0.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress allows Stored XSS. This issue affects Landing pages and Domain aliases for WordPress: from n/a through 0.8.

Vendor-wpdrift.no

Product-Landing pages and Domain aliases for WordPress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress WS Force Login Page <= 3.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silver Muru WS Force Login Page allows Stored XSS. This issue affects WS Force Login Page: from n/a through 3.0.3.

Vendor-Silver Muru

Product-WS Force Login Page

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress WP Customize Login Page <= 1.6.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page allows Stored XSS. This issue affects WP Customize Login Page: from n/a through 1.6.5.

Vendor-Carlo La Pera

Product-WP Customize Login Page

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:09

Updated-29 Apr, 2025 | 13:52

WordPress Floating Social Bar <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar allows Stored XSS. This issue affects Floating Social Bar: from n/a through 1.1.7.

Vendor-Awesome Motive Inc.

Product-Floating Social Bar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-24 Apr, 2025 | 16:08

Updated-29 Apr, 2025 | 13:52

WordPress Seriously Simple Podcasting plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting allows Stored XSS. This issue affects Seriously Simple Podcasting: from n/a through 3.9.0.

Vendor-Craig Hewitt

Product-Seriously Simple Podcasting

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-17 Apr, 2025 | 15:17

Updated-17 Apr, 2025 | 20:21

WordPress WP Post to PDF Enhanced plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beth Tucker Long WP Post to PDF Enhanced allows Stored XSS. This issue affects WP Post to PDF Enhanced: from n/a through 1.1.1.

Vendor-Beth Tucker Long

Product-WP Post to PDF Enhanced

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-17 Apr, 2025 | 15:46

Updated-17 Apr, 2025 | 20:21

WordPress Payment Form for PayPal Pro <= 1.1.72 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Payment Form for PayPal Pro allows Stored XSS. This issue affects Payment Form for PayPal Pro: from n/a through 1.1.72.

Vendor-CodePeople

Product-Payment Form for PayPal Pro

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-17 Apr, 2025 | 15:17

Updated-17 Apr, 2025 | 20:21

WordPress Gravity Forms CSS Themes with Fontawesome and Placeholders plugin <= 8.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maros Pristas Gravity Forms CSS Themes with Fontawesome and Placeholders allows Stored XSS. This issue affects Gravity Forms CSS Themes with Fontawesome and Placeholders: from n/a through 8.5.

Vendor-Maros Pristas

Product-Gravity Forms CSS Themes with Fontawesome and Placeholders

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 19.73%

||

7 Day CHG~0.00%

Published-08 Aug, 2023 | 10:05

Updated-19 Feb, 2025 | 21:27

WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin <= 0.6.11 versions.

Vendor-wp-cirrus_project Christian Kramer & Hendrik Thole

Product-wp-cirrus WP-Cirrus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-5.9||MEDIUM

EPSS-0.05% / 16.45%

||

7 Day CHG~0.00%

Published-16 May, 2025 | 06:00

Updated-22 May, 2025 | 17:03

Simple Lightbox < 2.9.4 - Contributor+ Stored XSS

The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Vendor-archetyped Unknown

Product-simple_lightbox Simple Lightbox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-5.9||MEDIUM

EPSS-0.05% / 15.23%

||

7 Day CHG~0.00%

Published-12 May, 2025 | 06:00

Updated-05 Jun, 2025 | 14:27

Firelight Lightbox < 2.3.15 - Contributor+ Stored XSS

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well.

Vendor-firelightwp Unknown

Product-firelight_lightbox Firelight Lightbox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.66%

||

7 Day CHG~0.00%

Published-27 May, 2025 | 14:39

Updated-28 May, 2025 | 15:01

WordPress Volunteer Sign Up Sheets plugin < 5.5.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DBAR Productions Volunteer Sign Up Sheets allows Stored XSS.This issue affects Volunteer Sign Up Sheets: from n/a before 5.5.5. The patch is available exclusively on GitHub at https://github.com/dbarproductions/pta-volunteer-sign-up-sheets , as the vendor encounters difficulties using SVN to deploy to the WordPress.org repository.

Vendor-DBAR Productions

Product-Volunteer Sign Up Sheets

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-5.9||MEDIUM

EPSS-0.15% / 35.63%

||

7 Day CHG~0.00%

Published-29 Apr, 2024 | 06:00

Updated-26 Mar, 2025 | 21:15

Smart Forms < 2.6.96 - Admin+ Stored XSS

The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Vendor-Unknown

Product-Smart Forms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.10%

||

7 Day CHG~0.00%

Published-10 Aug, 2023 | 13:08

Updated-25 Sep, 2024 | 16:44

WordPress Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin <= 2.0 versions.

Vendor-supito Sudipto Pratap Mahato

Product-mahato_simple_light_weight_social_share Simple Light Weight Social Share

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.10%

||

7 Day CHG~0.00%

Published-29 Feb, 2024 | 05:09

Updated-25 Mar, 2025 | 17:10

WordPress Media Alt Renamer Plugin 0.0.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Media Alt Renamer allows Stored XSS.This issue affects Media Alt Renamer: from n/a through 0.0.1.

Vendor-jordymeow Jordy Meow

Product-media_alt_renamer Media Alt Renamer

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.10%

||

7 Day CHG~0.00%

Published-10 Aug, 2023 | 11:52

Updated-25 Sep, 2024 | 15:04

WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <= 4.67 versions.

Vendor-smartypantsplugins Smartypants

Product-sp_project_\&_document_manager SP Project & Document Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.10%

||

7 Day CHG~0.00%

Published-04 Sep, 2023 | 09:27

Updated-19 Feb, 2025 | 21:24

WordPress Media Library Categories Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 2.0.0 versions.

Vendor-jeffrey-wp Jeffrey-WP

Product-media_library_categories Media Library Categories

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-09 Apr, 2025 | 16:09

Updated-09 Apr, 2025 | 20:02

WordPress Aria Font <= 1.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in آریا وردپرس Aria Font allows Stored XSS. This issue affects Aria Font: from n/a through 1.4.

Vendor-آریا وردپرس

Product-Aria Font

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-04 Apr, 2025 | 15:58

Updated-07 Apr, 2025 | 14:18

WordPress Secure Copy Content Protection and Content Locking plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking allows Stored XSS. This issue affects Secure Copy Content Protection and Content Locking: from n/a through 4.5.1.

Vendor-AYS Pro Extensions

Product-Secure Copy Content Protection and Content Locking

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-09 Apr, 2025 | 16:09

Updated-09 Apr, 2025 | 20:02

WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor One Click Accessibility allows Stored XSS. This issue affects One Click Accessibility: from n/a through 3.1.0.

Vendor-Elementor

Product-One Click Accessibility

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-04 Apr, 2025 | 15:58

Updated-07 Apr, 2025 | 14:18

WordPress Posts Footer Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Migitation, Inc. Posts Footer Manager allows Stored XSS. This issue affects Posts Footer Manager: from n/a through 2.2.0.

Vendor-Data443 Risk Migitation, Inc.

Product-Posts Footer Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 08:09

Updated-11 Apr, 2025 | 15:39

WordPress Lightbox & Modal Popup WordPress Plugin – FooBox plugin <= 2.7.33 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bradvin FooBox Image Lightbox . This issue affects FooBox Image Lightbox : from n/a through 2.7.33.

Vendor-bradvin

Product-FooBox Image Lightbox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-09 Apr, 2025 | 16:09

Updated-09 Apr, 2025 | 20:02

WordPress BP Social Connect <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes BP Social Connect allows Stored XSS. This issue affects BP Social Connect: from n/a through 1.6.2.

Vendor-VibeThemes

Product-BP Social Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-04 Apr, 2025 | 15:58

Updated-07 Apr, 2025 | 14:18

WordPress Social Intents plugin <= 1.6.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in socialintents Social Intents allows Stored XSS. This issue affects Social Intents: from n/a through 1.6.14.

Vendor-socialintents

Product-Social Intents

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-04 Apr, 2025 | 15:58

Updated-07 Apr, 2025 | 14:18

WordPress FunnelCockpit Plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit allows Stored XSS. This issue affects FunnelCockpit: from n/a through 1.4.2.

Vendor-FunnelCockpit

Product-FunnelCockpit

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 12.38%

||

7 Day CHG-0.05%

Published-22 Jul, 2024 | 08:38

Updated-02 Aug, 2024 | 03:50

WordPress Depicter Slider plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.0.2.

Vendor-Depicter (Averta)

Product-depicter Depicter Slider

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.03% / 7.81%

||

7 Day CHG~0.00%

Published-22 Aug, 2025 | 11:59

Updated-22 Aug, 2025 | 18:08

WordPress Recurring PayPal Donations Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations allows Stored XSS. This issue affects Recurring PayPal Donations: from n/a through 1.8.

Vendor-wpecommerce

Product-Recurring PayPal Donations

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.08% / 25.50%

||

7 Day CHG+0.01%

Published-20 Jul, 2024 | 08:49

Updated-02 Aug, 2024 | 04:04

WordPress ReCaptcha Integration for WordPress plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in weDevs ReCaptcha Integration for WordPress allows Stored XSS.This issue affects ReCaptcha Integration for WordPress: from n/a through 1.2.5.

Vendor-weDevs Pte. Ltd.

Product-ReCaptcha Integration for WordPress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.06% / 18.53%

||

7 Day CHG~0.00%

Published-09 Apr, 2025 | 16:09

Updated-09 Apr, 2025 | 20:02

WordPress Admin Menu Post List <= 2.0.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eliot Akira Admin Menu Post List allows Stored XSS. This issue affects Admin Menu Post List: from n/a through 2.0.7.

Vendor-Eliot Akira

Product-Admin Menu Post List

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG~0.00%

Published-28 Mar, 2025 | 11:54

Updated-28 Mar, 2025 | 18:11

WordPress TGG WP Optimizer <= 1.22 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Preetinder Singh TGG WP Optimizer allows Stored XSS. This issue affects TGG WP Optimizer: from n/a through 1.22.

Vendor-Preetinder Singh

Product-TGG WP Optimizer

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.66%

||

7 Day CHG~0.00%

Published-06 Jun, 2025 | 12:54

Updated-06 Jun, 2025 | 15:04

WordPress ACF: Yandex Maps Field <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unreal Themes ACF: Yandex Maps Field allows Stored XSS. This issue affects ACF: Yandex Maps Field: from n/a through 1.1.

Vendor-Unreal Themes

Product-ACF: Yandex Maps Field

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG~0.00%

Published-28 Mar, 2025 | 11:54

Updated-28 Mar, 2025 | 18:11

WordPress Page Takeover <= 1.1.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Page Takeover allows Stored XSS. This issue affects Page Takeover: from n/a through 1.1.6.

Vendor-FancyThemes

Product-Page Takeover

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG~0.00%

Published-27 Mar, 2025 | 22:25

Updated-28 Mar, 2025 | 18:11

WordPress VaultRE Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored XSS.This issue affects VaultRE Contact Form 7: from n/a through 1.0.

Vendor-Vault Group Pty Ltd

Product-VaultRE Contact Form 7

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG-0.04%

Published-31 Mar, 2025 | 12:55

Updated-01 Apr, 2025 | 20:26

WordPress Elfsight Testimonials Slider plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Testimonials Slider allows Stored XSS. This issue affects Elfsight Testimonials Slider: from n/a through 1.0.1.

Vendor-elfsight

Product-Elfsight Testimonials Slider

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG~0.00%

Published-28 Mar, 2025 | 11:54

Updated-03 Apr, 2025 | 12:57

WordPress Duplicate Page and Post <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Falcon Solutions Duplicate Page and Post allows Stored XSS. This issue affects Duplicate Page and Post: from n/a through 1.0.

Vendor-Falcon Solutions

Product-Duplicate Page and Post

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.04% / 11.66%

||

7 Day CHG~0.00%

Published-06 Jun, 2025 | 12:54

Updated-06 Jun, 2025 | 15:08

WordPress Responsify WP <= 1.9.11 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stefanledin Responsify WP allows Stored XSS. This issue affects Responsify WP: from n/a through 1.9.11.

Vendor-stefanledin

Product-Responsify WP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG-0.04%

Published-31 Mar, 2025 | 12:55

Updated-01 Apr, 2025 | 20:26

WordPress Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gingerplugins Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme allows Stored XSS. This issue affects Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme: from n/a through 1.1.

Vendor-gingerplugins

Product-Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG-0.04%

Published-31 Mar, 2025 | 12:55

Updated-01 Apr, 2025 | 20:26

WordPress Welcome Popup plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Welcome Popup allows Stored XSS. This issue affects Welcome Popup: from n/a through 1.0.10.

Vendor-WeblineIndia

Product-Welcome Popup

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG-0.04%

Published-01 Apr, 2025 | 14:52

Updated-01 Apr, 2025 | 20:26

WordPress WebinarPress plugin <= 1.33.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWebinarSystem WebinarPress allows Stored XSS. This issue affects WebinarPress: from n/a through 1.33.27.

Vendor-WPWebinarSystem

Product-WebinarPress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.02% / 4.31%

||

7 Day CHG-0.04%

Published-01 Apr, 2025 | 14:51

Updated-01 Apr, 2025 | 20:26

WordPress WP Proposals plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.

Vendor-WP Codeus

Product-WP Proposals

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')