CVE-2026-66030

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...

CVE-2026-66395

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-66474

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

CVE-2026-66474

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

CVE-2026-66474 WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

CVE-2026-66474

CVE-2026-66474 is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin Insert Headers and Footers Code – HT Script up to version 1.1.8 . The issue is described as CSRF in versions

CVE-2026-66474 WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

EUVD-2026-49249

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Insert Headers and Footers Code – HT Script versions = 1.1.8...

CVE-2026-10082

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

CVE-2026-14827 Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...

CVE-2026-10082

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

EUVD-2026-49064

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

PT-2026-64845

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

PT-2026-64831

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

PT-2026-64969

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

CVE-2026-66474: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Insert Headers and Footers Code – HT Script = 1.1.8 versions...

CVE-2026-17497 NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...

CVE-2026-17496

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

JLSEC-2026-796 XSS via unescaped code-fence language in default code block renderer

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out...