CVE-2026-120035

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'itemtitle parsed from feed ' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization an...

CVE-2026-107658

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bfposttype and buddyformsformcontent' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2026-119178

The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-119211

The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionpage' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-116545

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'customfields.value.label for key='track'' parameter in all versions up to, and including, 5.0.0 due to insufficient...

CVE-2026-116551

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-84164

The CodeChecker tool (specifically functions plist-to-html, parse --export html, and cmd diff --output html) is vulnerable to Stored XSS during static HTML report export. The root cause is that json.dumps fails to escape the less-than character (

awesome-oneliner-bugbounty

Awesome One-liner Bug Bounty A collection of awesome one-liner scripts especially for bug bounty. This repository stores and houses various one-liner for bug bounty tips provided by me as well as contributed by the community. Your contributions and suggestions are heartily♥ welcome. Definitions...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...

CVE-2026-123309

JetBrains IntelliJ IDEA versions before 2026.3 (specifically 2026.2.4) are vulnerable to stored XSS on the built-in web server. The vulnerability is triggered via the Markdown preview feature. This flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and h...

CVE-2026-123301

JetBrains IntelliJ IDEA versions prior to 2026.3 are vulnerable to a DOM-based Cross-Site Scripting (XSS) flaw within the OpenAPI preview error view . The underlying cause is the improper neutralization of input during web page generation (CWE-79 ). This vulnerability allows an attacker to execut...

CVE-2026-123288

A stored Cross-Site Scripting (XSS) vulnerability exists in JetBrains Datalore versions prior to 2026.4 . The issue is triggered via a Vega editor link within notebook charts, leading to the execution of malicious scripts in the context of the victim's session. The vulnerability is associated wit...

B-XSSRF

B-XSSRF Toolkit to detect and keep track on Blind XSS, XXE & SSRF SETUP Upload the files to your server. Create a Database and upload database.sql file to it. Change the DB Credentials in db.php file. Ready. USAGE BLIND XSS BLIND XXE %ext; SSRF GET /testssrf.php=http://mysite.com/bxssrf/request.p...

xssor2

XSS'OR XSS'OR - Hack with JavaScript. ONLINE You can have a try: https://xssor.io and http://xssor.io/ It contains three major modules: Encode/Decode, Codz, Probe. INSTALL Python 3 with Django 3.0. or Python 2 with Django 1.11. git clone https://github.com/evilcos/xssor2 or download directly cd...

CVE-2026-97642

The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 6.4 . The vulnerability exists in the calendar Gutenberg block due to insufficient input sanitization and output escaping of the 'theme' attribute . Specifically, the printCale...

CVE-2026-110776

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.1 . The root cause is insufficient input sanitization and output escaping of the 'vars' parameter . An unauthenticated attacker can inject arbitra...

CVE-2026-120550

The WP User Manager plugin for WordPress (versions up to and including 2.10.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the name parameter of the REST users endpoint (wp_users.display_name). This allows authenti...

HackTools

Welcome to HackTools ! Introduction — Preview — Install — Build — Support !NOTE Psst... Loved HackTools? 👀 Check out Penflow - our new security testing companion! Try it at map.penflow.sh 🚀 !NOTE Dear Users, We're excited to announce a major revamp of our app! Due to recent changes and multiple...

vulnknox

VulnKnoX VulnKnox is a powerful command-line tool written in Go that interfaces with the KNOXSS API. It automates the process of testing URLs for Cross-Site Scripting XSS vulnerabilities using the advanced capabilities of the KNOXSS engine. Features Supports pipe input for passing file lists and...

CVE-2026-122222

The Permalink Manager Lite plugin for WordPress (versions ¢= 2.6.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'slug' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Author-level access or higher can submit a p...