CVE-2026-50980

CVE-2026-50980: DNS-Based Cross-Site Scripting XSS & Session Hijacking in oPanel Overview CVE ID: CVE-2026-50980 Product: oPanel Affected Versions: v1.20.25 Vulnerability Type: Stored Cross-Site Scripting XSS via DNS / Session Hijacking Severity: High CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N...

CheckFlashPlayerVersion

CheckFlashPlayerVersion Check the Browser's FlashPlayer version to check if it is vulnerable to exploit CVE-2016-7855 Usage: Clone this repository and then open the html file in the browser where you want to check the Flash Player version...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...

CVE-2025-55780

CVE-2025-55780 Null Pointer De-reference in MuPDF 1.26.4 EPUB Rendering Function CVE Reference - CVE-2025-55780 Affected Versions : 1.26.7 and before are affected Found and tested on : 1.26.4 Severity CVSSv3 score : 7.5 High Fixed in commit :...

CVE-2020-11022

So here's the thing So here's the thing guys, CVE-2020-11022 is a vulnerability in jQuery versions below 3.5.0 or above, CVE-2020-11022 itself triggers an XSS by leveraging DOM Manipulation e.g., .html, .append, and others to execute malicious XSS code. 1. Verify jQuery Version: Make sure the...

CVE-2026-84930

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

CVE-2026-84931

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-84021

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...

CVE-2026-83544

The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-84896

The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...

CVE-2026-19861

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...

CVE-2026-8625

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

CVE-2026-84896 King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget

The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...

EUVD-2026-71865

The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...

CVE-2026-84896

King Addons for Elementor WordPress plugin versions before 51.1.77 suffer from a Contributor+ Stored XSS vulnerability in the Magazine Grid Widget . A widget display-style setting is not properly escaped before being output in an HTML attribute, allowing users with Contributor-level access or hig...

CVE-2026-84021 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...

EUVD-2026-71859

The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-84021 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...

EUVD-2026-71847

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...

CVE-2026-8625

Dear Flipbook (PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer) for WordPress is vulnerable to Authenticated Stored XSS in all versions up to and including 2.4.30 . An attacker with Contributor-level access can inject a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML bloc...