Description
Multiple cross-site scripting (XSS) vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post_id parameter to ecrire/trackback.php or the (2) tool_url parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third party information.
Remediation
References
Related Vulnerabilities
WordPress Plugin YITH WooCommerce Gift Cards Premium Arbitrary File Upload (3.19.0)
WordPress Plugin Alpine PhotoTile for Instagram Cross-Site Scripting (1.2.6.5)
WordPress 3.8.x Multiple Vulnerabilities (3.8 - 3.8.14)
Liferay DXP Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2022-42129)
Python Improper Input Validation Vulnerability (CVE-2026-4519)