CVE-2026-87915

The Popup Maker WordPress plugin is vulnerable to unauthenticated stored cross-site scripting (XSS) via the values[Name] parameter in all versions up to and including 1.24.0 . The root cause is insufficient input sanitization and output escaping : although wp_kses is applied on output, HTML entit...

CVE-2026-87915: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

GHSA-J5C3-R84F-9596 Arbitrary File Read in Admin JS CSS files

Impact It was observed that the /admin/misc/script-proxy API endpoint accessible by an authenticated administrator user and is vulnerable arbitrary JavaScript, CSS file read via the "scriptPath" and "scripts" parameters. The "scriptPath" parameter is not sanitized properly and is vulnerable to pa...

CVE-2022-34988

Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the component /admin/js...

CVE-2022-34988: Improper Neutralization of Input During Web Page Generation

Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the component /admin/js...

CVE-2020-10386

admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory...

CVE-2017-6818: Improper Neutralization of Input During Web Page Generation

In WordPress before 4.7.3 wp-admin/js/tags-box.js, there is cross-site scripting XSS via taxonomy term names...

CVE-2015-5733: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title...