114439 matches found
CVE-2026-1661
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...
CVE-2026-1661
The WP Mail Logging WordPress plugin, in versions prior to 1.17.0 , is vulnerable to HTML injection because it fails to properly restrict the HTML and CSS of logged emails before rendering them in admin log screens. This allows unauthenticated users to inject styled content and links—for instance...
CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...
CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...
CLEANSTART-2026-ED72933 html
Security vulnerability affects the consul package. The html...
CLEANSTART-2026-NS73897 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-LZ15854 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-TS90060 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
Security vulnerability affects the consul package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
CLEANSTART-2026-RI83970 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-LK92318 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CVE-2026-104900: Improper Neutralization of Input During Web Page Generation
MISP contains a stored cross-site scripting XSS vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked...
CVE-2026-104450: Improper Neutralization of Input During Web Page Generation
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...
CVE-2026-1661: Improper Neutralization of Input During Web Page Generation
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...
PT-2026-104395
Name of the Vulnerable Software and Affected Versions prosemirror-view versions prior to 1.42.3 Description The view component, which manages the editable browser interface for documents, contains a flaw in its paste handling. It accepts attacker-provided HTML where the clipboard slice context...
PT-2026-104280
Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7 Description A server-side request forgery SSRF issue exists in the Bazar valeur action. Page editors can force the server to fetch arbitrary URLs by manipulating the url parameter. By embedding this action with ...
CVE-2026-93756: Improper Neutralization of Input During Web Page Generation
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...
Google Chrome < 154.0.8037.97 Multiple Vulnerabilities
The version of Google Chrome installed on the remote macOS host is prior to 154.0.8037.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop advisory. - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remo...
CVE-2026-104413: Improper Neutralization of Input During Web Page Generation
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...
PT-2026-104103
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...
