CVE-2026-40581

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint SelectDelete.php performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a...

CVE-2025-13072

The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-41912

Name of the Vulnerable Software and Affected Versions Affected versions not specified Description A security issue exists that allows for unintended configuration modification. This is due to missing cross-site request forgery CSRF checks on a form. An attacker could convince an authenticated...

PT-2024-34408 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.6 Description: The issue concerns a lack of CSRF check and missing sanitization as well as escaping in certain areas, potentially allowing attackers to inject Stored XSS payloads via a CSRF...

CVE-2023-3936

The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-14585 · WordPress · The Real Cookie Banner

Name of the Vulnerable Software and Affected Versions: The Real Cookie Banner WordPress plugin versions prior to 3.4.10 Description: The issue allows users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins. This is due to the plugin not...

CVE-2021-44478

A vulnerability has been identified in Polarion ALM All versions V21 R2 P2, Polarion WebClient for SVN All versions. A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to...