8 matches found
WordPress BE REST Endpoints plugin <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation vulnerability
Unauthenticated Stored XSS and Widget Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin BE REST Endpoints versions = 1.0.0...
CVE-2026-81742
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...
CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...
CVE-2026-81742
The BE REST Endpoints WordPress plugin, in versions through 1.0.0 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) and widget manipulation . The root cause is a failure to perform authorization checks before allowing widgets to be read, created, updated, or deleted, combined w...
EUVD-2026-76786
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...
CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...
CVE-2026-81742: Improper Neutralization of Input During Web Page Generation
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...
PT-2026-90569
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...