Affected: sebet Go Fetch Jobs (for WP Job Manager), 5starplugins Dynamic Copyright Year, peterschulznl Code Manager, bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior, yuvalo Goal Tracker – Custom Event Tracking for GA4, essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent, josevega WP Page Templates, hkdigitalagency Payment Gateway for ACBA BANK, princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress, spiderdevs Forumax – AI Powered Advanced Community Forum Plugin and 121 more

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.